CVE-2018-1000301

Published: May 24, 2018Modified: Apr 15, 2026

9.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

Affected (18)

Products: Debian: Debian Linux · Canonical: Ubuntu Linux · Haxx: Curl · +2 more

Show all products

Debian: Debian Linux · Canonical: Ubuntu Linux · Haxx: Curl · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation · Oracle: Communications Webrtc Session Controller, Enterprise Manager Ops Center, Peoplesoft Enterprise Peopletools

1 product

1 product

1 product

3 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Workstation

3 products

Communications Webrtc Session Controller

Enterprise Manager Ops Center

Peoplesoft Enterprise Peopletools

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 17.10
Canonical Ubuntu Linux	Version 18.04

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	From 7.20.0 to 7.59.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration E

6 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Webrtc Session Controller	Before 7.2
Oracle Enterprise Manager Ops Center	Version 12.2.2
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Peoplesoft Enterprise Peopletools	Version 8.55
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (34)

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: cve@mitre.org

Patch

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/104225

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040931

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHBA-2019:0327

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3157

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3558

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0544

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2020:0594

Source: cve@mitre.org

https://curl.haxx.se/docs/adv_2018-b138.html

Source: cve@mitre.org

PatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201806-05

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/3598-2/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/3648-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2018/dsa-4202

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: cve@mitre.org

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/bid/104225

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040931

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHBA-2019:0327

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3157

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:3558

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0544

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2020:0594

Source: af854a3a-2127-422b-91ae-364da2661108

https://curl.haxx.se/docs/adv_2018-b138.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201806-05

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/3598-2/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/3648-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2018/dsa-4202

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.