Skip to content
Fencer Vulns
critical 9.8

CVE-2018-1000120 in the critical feed json

curl FTP path confusion leads to NIL byte out of bounds write

published 2018-03-14 8 y ago modified 2026-06-17 4 mo ago also GHSA-674j-7m97-j2p9 , EUVD-2022-2735

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
11.6%
EPSS 11.6% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.

Patch / fix

  • oracle communications_webrtc_session_controller 7.2
  • curl Debian 14, Debian 13, Debian 12 7.60.0-1

debian advisories DEBIAN-CVE-2018-1000120

  • curl Ubuntu 14.04 LTS 7.35.0-1ubuntu2.15
  • curl Ubuntu 16.04 LTS 7.47.0-1ubuntu2.7
  • curl Ubuntu 18.04 LTS 7.58.0-2ubuntu3

ubuntu advisories UBUNTU-CVE-2018-1000120

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • httpd24-curl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el6
  • httpd24-curl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el7
  • httpd24-httpd RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el6
  • httpd24-httpd RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el7
  • httpd24-mod_md RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el7
  • httpd24-libcurl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el6
  • httpd24-libcurl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el7
  • httpd24-mod_ssl RHEL 3 SOFTWARE_COLLECTIONS 1:2.4.34-7.el6

red hat advisories RHSA-2020:0594RHSA-2020:0544RHSA-2018:3558RHSA-2018:3157

  • curl Studio Onsite 1.3 7.19.7-1.20.53.16.1
  • curl SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +3 more 7.37.0-70.27.1
  • curl-openssl1 SLES 11-SECURITY, SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS 7.37.0-70.27.1
  • curl SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +6 more 7.37.0-37.17.1

suse advisories SUSE-SU-2018:2629-1SUSE-SU-2018:1323-1SUSE-SU-2018:0769-1

  • curl openSUSE Tumbleweed 7.79.1-1.1

opensuse advisories openSUSE-SU-2024:10582-1

  • curl Alpine 3.24, Alpine 3.23, Alpine 3.22 +18 more 7.59.0-r0

alpine advisories ALPINE-CVE-2018-1000120

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • curl Arch Linux 7.59.0-1
  • lib32-curl Arch Linux 7.59.0-1
  • libcurl-compat Arch Linux 7.59.0-1
  • lib32-libcurl-gnutls Arch Linux 7.59.0-1
  • lib32-libcurl-compat Arch Linux 7.59.0-1
  • libcurl-gnutls Arch Linux 7.59.0-1

arch linux advisories AVG-653AVG-654AVG-655AVG-656AVG-660AVG-661

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000120 updated cvss 5.4

curl: FTP path trickery leads to NIL byte out of bounds write

  • Red Hat .NET Core 1.0 on Red Hat Enterprise Linux rh-dotnetcore10-curl Red Hat .NET Core 1.1 on Red Hat Enterprise Linux rh-dotnetcore11-curl Red Hat .NET Core 2.0 on Red Hat Enterprise Linux rh-dotnet20-curl Red Hat .NET Core 2.1 on Red Hat Enterprise Linux rh-dotnet21-curl, rh-dotnet21-libcurl Red Hat Ceph Storage 2 curl, libcurl Red Hat Enterprise Linux 5 curl
    +1 more products
    Red Hat Enterprise Linux 6 curl, libcurl
    affected: workaround, no fix planned “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.”
  • Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2019:1543
  • Red Hat Enterprise Linux Client (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7 Red Hat Enterprise Linux Client Optional (v. 7) libcurl-devel 7.29.0-51.el7, curl-debuginfo 7.29.0-51.el7 Red Hat Enterprise Linux ComputeNode (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2018:3157
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) curl 7.29.0-46.el7_5.1, libcurl 7.29.0-46.el7_5.1
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2020:0544
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcurl-devel 7.29.0-51.el7, curl-debuginfo 7.29.0-51.el7
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2018:3157
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) libcurl-devel 7.29.0-46.el7_5.1, curl-debuginfo 7.29.0-46.el7_5.1
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2020:0544
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7 Red Hat Enterprise Linux Server (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2018:3157
  • Red Hat Enterprise Linux Server AUS (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2 Red Hat Enterprise Linux Server E4S (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2020:0594
show 5 more
  • Red Hat Enterprise Linux Server EUS (v. 7.5) curl 7.29.0-46.el7_5.1, libcurl 7.29.0-46.el7_5.1
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2020:0544
  • Red Hat Enterprise Linux Server TUS (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2020:0594
  • Red Hat Enterprise Linux Workstation (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2018:3157
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-curl 7.61.1-1.el6, httpd24-httpd 2.4.34-7.el6, httpd24-nghttp2 1.7.1-7.el6, httpd24-libcurl 7.61.1-1.el6, httpd24-mod_ssl 2.4.34-7.el6, httpd24-mod_ldap 2.4.34-7.el6, +5 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-curl 7.61.1-1.el6, httpd24-httpd 2.4.34-7.el6, httpd24-nghttp2 1.7.1-7.el6, httpd24-libcurl 7.61.1-1.el6, httpd24-mod_ssl 2.4.34-7.el6, httpd24-mod_ldap 2.4.34-7.el6, +5 more
    +1 more products
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more
    fixed: vendor fix “Preventing application from using non-default CURLOPT_FTP_FILEMETHOD will avoid triggering the vulnerable code.” RHSA-2018:3558
  • Red Hat Enterprise Linux 8 curl, libcurl, libcurl-minimal
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-19-155-01 updated cvss 9.8

PHOENIX CONTACT PLCNext AXC F 2152

  • Phoenix Contact AXC F 2152 2404267 version 1.x, 1046568 (Starterkit) version 1.x
    affected: vendor fix, mitigation “Phoenix Contact recommends affected users update to firmware release 2019.0 LTS or later, update to PLCNext Engineer release 2019.0 LTS or later, and apply the following specific mitigations below:” phoenixcontact.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

11.61% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
nuget curl
>=7.12.3
 no fix listed

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.