CVE-2018-1000122

Published: Mar 14, 2018Modified: Nov 21, 2024

9.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage

Affected (17)

Products: Debian: Debian Linux · Canonical: Ubuntu Linux · Haxx: Curl · +2 more

Show all products

Debian: Debian Linux · Canonical: Ubuntu Linux · Haxx: Curl · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation · Oracle: Communications Webrtc Session Controller, Enterprise Manager Ops Center, Peoplesoft Enterprise Peopletools

1 product

1 product

1 product

3 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Workstation

3 products

Communications Webrtc Session Controller

Enterprise Manager Ops Center

Peoplesoft Enterprise Peopletools

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 17.10

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	From 7.20.0 to 7.58.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration E

6 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Webrtc Session Controller	Before 7.2
Oracle Enterprise Manager Ops Center	Version 12.2.2
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Peoplesoft Enterprise Peopletools	Version 8.55
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (34)

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: cve@mitre.org

Patch

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/103436

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040530

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHBA-2019:0327

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3157

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3558

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1543

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2020:0544

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2020:0594

Source: cve@mitre.org

https://curl.haxx.se/docs/adv_2018-b047.html

Source: cve@mitre.org

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://usn.ubuntu.com/3598-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/3598-2/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2018/dsa-4136

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: cve@mitre.org

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/bid/103436

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040530

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHBA-2019:0327

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3157

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3558

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1543

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2020:0544

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2020:0594

Source: af854a3a-2127-422b-91ae-364da2661108

https://curl.haxx.se/docs/adv_2018-b047.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://usn.ubuntu.com/3598-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/3598-2/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2018/dsa-4136

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.