CVE-2018-1000301
Fixed in a distro release EPSS 6%CVSS 9.1
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
Products: debian_linux, canonical ubuntu_linux, haxx curl, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_workstation, oracle communications_webrtc_session_controller, oracle enterprise_manager_ops_center, oracle peoplesoft_enterprise_peopletools
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | curl | 7.60.0-r0 |
| Alpine 3.11 | curl | 7.60.0-r0 |
| Alpine 3.12 | curl | 7.60.0-r0 |
| Alpine 3.13 | curl | 7.60.0-r0 |
| Alpine 3.14 | curl | 7.60.0-r0 |
| Alpine 3.15 | curl | 7.60.0-r0 |
| Alpine 3.16 | curl | 7.60.0-r0 |
| Alpine 3.17 | curl | 7.60.0-r0 |
| Alpine 3.18 | curl | 7.60.0-r0 |
| Alpine 3.19 | curl | 7.60.0-r0 |
| Alpine 3.20 | curl | 7.60.0-r0 |
| Alpine 3.21 | curl | 7.60.0-r0 |
| Alpine 3.22 | curl | 7.60.0-r0 |
| Alpine 3.23 | curl | 7.60.0-r0 |
| Alpine 3.24 | curl | 7.60.0-r0 |
| Alpine 3.4 | curl | 7.60.0-r0 |
| Alpine 3.5 | curl | 7.60.0-r0 |
| Alpine 3.6 | curl | 7.60.0-r0 |
| Alpine 3.7 | curl | 7.60.0-r0 |
| Alpine 3.8 | curl | 7.60.0-r0 |
| Alpine 3.9 | curl | 7.60.0-r0 |
| Amazon Linux 2 | curl | 7.55.1-12.amzn2.0.1 |
| Amazon Linux 2 | libcurl | 7.55.1-12.amzn2.0.1 |
| Amazon Linux 2 | libcurl-devel | 7.55.1-12.amzn2.0.1 |
| Amazon Linux 2 | nss-pem | 1.0.3-5.amzn2 |
| Arch Linux | curl | 7.60.0-1 |
| Arch Linux | lib32-curl | 7.60.0-1 |
| Arch Linux | lib32-libcurl-compat | 7.60.0-1 |
| Arch Linux | lib32-libcurl-gnutls | 7.60.0-1 |
| Arch Linux | libcurl-compat | 7.60.0-1 |
| Arch Linux | libcurl-gnutls | 7.60.0-1 |
| Debian 12 | curl | 7.60.0-1 |
| Debian 13 | curl | 7.60.0-1 |
| Debian 14 | curl | 7.60.0-1 |
| Debian 7 | curl | 7.26.0-1+wheezy25+deb7u1 |
| Debian 8 | curl | 7.38.0-4+deb8u11 |
| Debian 9 | curl | 7.52.1-5+deb9u6 |
| Red Hat Enterprise Linux 7 | curl | 0:7.29.0-51.el7 |
| Red Hat Enterprise Linux 7 | curl-debuginfo | 0:7.29.0-51.el7 |
| Red Hat Enterprise Linux 7 | libcurl | 0:7.29.0-51.el7 |
| Red Hat Enterprise Linux 7 | libcurl-devel | 0:7.29.0-51.el7 |
| Red Hat Enterprise Linux 7 | nss-pem | 0:1.0.3-5.el7 |
| Red Hat Enterprise Linux 7 | nss-pem-debuginfo | 0:1.0.3-5.el7 |
| Red Hat rhel aus 7.4 | curl | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel aus 7.4 | curl-debuginfo | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel aus 7.4 | libcurl | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel aus 7.4 | libcurl-devel | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel e4s 7.4 | curl | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel e4s 7.4 | curl-debuginfo | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel e4s 7.4 | libcurl | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel e4s 7.4 | libcurl-devel | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel eus 7.5 | curl | 0:7.29.0-46.el7_5.1 |
| Red Hat rhel eus 7.5 | curl-debuginfo | 0:7.29.0-46.el7_5.1 |
| Red Hat rhel eus 7.5 | libcurl | 0:7.29.0-46.el7_5.1 |
| Red Hat rhel eus 7.5 | libcurl-devel | 0:7.29.0-46.el7_5.1 |
| Red Hat rhel software collections 3 | httpd24-curl | 0:7.61.1-1.el7 |
| Red Hat rhel software collections 3 | httpd24-curl | 0:7.61.1-1.el6 |
| Red Hat rhel software collections 3 | httpd24-curl-debuginfo | 0:7.61.1-1.el7 |
| Red Hat rhel software collections 3 | httpd24-curl-debuginfo | 0:7.61.1-1.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd-debuginfo | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd-debuginfo | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd-devel | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd-devel | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd-manual | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd-manual | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd-tools | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd-tools | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-libcurl | 0:7.61.1-1.el7 |
| Red Hat rhel software collections 3 | httpd24-libcurl | 0:7.61.1-1.el6 |
| Red Hat rhel software collections 3 | httpd24-libcurl-devel | 0:7.61.1-1.el7 |
| Red Hat rhel software collections 3 | httpd24-libcurl-devel | 0:7.61.1-1.el6 |
| Red Hat rhel software collections 3 | httpd24-libnghttp2 | 0:1.7.1-7.el7 |
| Red Hat rhel software collections 3 | httpd24-libnghttp2 | 0:1.7.1-7.el6 |
| Red Hat rhel software collections 3 | httpd24-libnghttp2-devel | 0:1.7.1-7.el6 |
| Red Hat rhel software collections 3 | httpd24-libnghttp2-devel | 0:1.7.1-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_ldap | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_ldap | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-mod_md | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_proxy_html | 1:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_proxy_html | 1:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-mod_session | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-mod_session | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_ssl | 1:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_ssl | 1:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-nghttp2 | 0:1.7.1-7.el7 |
| Red Hat rhel software collections 3 | httpd24-nghttp2 | 0:1.7.1-7.el6 |
| Red Hat rhel software collections 3 | httpd24-nghttp2-debuginfo | 0:1.7.1-7.el7 |
| Red Hat rhel software collections 3 | httpd24-nghttp2-debuginfo | 0:1.7.1-7.el6 |
| Red Hat rhel tus 7.4 | curl | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel tus 7.4 | curl-debuginfo | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel tus 7.4 | libcurl | 0:7.29.0-42.el7_4.2 |
| Red Hat rhel tus 7.4 | libcurl-devel | 0:7.29.0-42.el7_4.2 |
| SUSE Enterprise Storage 4 | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Server 11 SP4 | curl | 7.37.0-70.30.1 |
| SUSE Linux Enterprise Server 11-SECURITY | curl-openssl1 | 7.37.0-70.30.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Server 12 SP3 | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Server 12-LTSS | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | curl | 7.37.0-70.30.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | curl | 7.37.0-37.23.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | curl | 7.37.0-70.30.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | curl | 7.37.0-37.23.1 |
| SUSE OpenStack Cloud 7 | curl | 7.37.0-37.23.1 |
| Ubuntu 14.04 LTS | curl | 7.35.0-1ubuntu2.16 |
| Ubuntu 16.04 LTS | curl | 7.47.0-1ubuntu2.8 |
| Ubuntu 18.04 LTS | curl | 7.58.0-2ubuntu3.1 |
| openSUSE Tumbleweed | curl | 7.79.1-1.1 |