Skip to content
Fencer Vulns
critical 9.1

CVE-2018-1000122 json

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a deni…

published 2018-03-14 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1846

cvss
9.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
9.0%
EPSS 9.0% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage

Patch / fix

  • oracle communications_webrtc_session_controller 7.2
  • curl Debian 14, Debian 13, Debian 12 7.60.0-1

debian advisories DEBIAN-CVE-2018-1000122

  • curl Ubuntu 14.04 LTS 7.35.0-1ubuntu2.15
  • curl Ubuntu 16.04 LTS 7.47.0-1ubuntu2.7
  • curl Ubuntu 18.04 LTS 7.58.0-2ubuntu3

ubuntu advisories UBUNTU-CVE-2018-1000122

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • httpd24-curl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el6
  • httpd24-curl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el7
  • httpd24-httpd RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el6
  • httpd24-httpd RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el7
  • httpd24-mod_md RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el7
  • httpd24-libcurl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el6
  • httpd24-libcurl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el7
  • httpd24-mod_ssl RHEL 3 SOFTWARE_COLLECTIONS 1:2.4.34-7.el6

red hat advisories RHSA-2020:0594RHSA-2020:0544RHSA-2018:3558RHSA-2018:3157

  • curl SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +3 more 7.37.0-70.27.1
  • curl-openssl1 SLES 11-SECURITY, SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS 7.37.0-70.27.1
  • curl SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +6 more 7.37.0-37.17.1

suse advisories SUSE-SU-2018:1323-1SUSE-SU-2018:0769-1

  • curl openSUSE Tumbleweed 7.79.1-1.1

opensuse advisories openSUSE-SU-2024:10582-1

  • curl Alpine 3.24, Alpine 3.23, Alpine 3.22 +18 more 7.59.0-r0

alpine advisories ALPINE-CVE-2018-1000122

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • curl Arch Linux 7.59.0-1
  • lib32-curl Arch Linux 7.59.0-1
  • libcurl-compat Arch Linux 7.59.0-1
  • lib32-libcurl-gnutls Arch Linux 7.59.0-1
  • lib32-libcurl-compat Arch Linux 7.59.0-1
  • libcurl-gnutls Arch Linux 7.59.0-1

arch linux advisories AVG-653AVG-654AVG-655AVG-656AVG-660AVG-661

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000122 updated cvss 6.5

curl: RTSP RTP buffer over-read

  • Red Hat .NET Core 1.0 on Red Hat Enterprise Linux rh-dotnetcore10-curl Red Hat .NET Core 1.1 on Red Hat Enterprise Linux rh-dotnetcore11-curl Red Hat .NET Core 2.0 on Red Hat Enterprise Linux rh-dotnet20-curl
    affected: no fix planned “Out of support scope”
  • Red Hat .NET Core 2.1 on Red Hat Enterprise Linux rh-dotnet21-curl, rh-dotnet21-libcurl Red Hat Ceph Storage 2 curl, libcurl
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2
    fixed: vendor fix RHSA-2019:1543
  • Red Hat Enterprise Linux Client (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7 Red Hat Enterprise Linux Client Optional (v. 7) libcurl-devel 7.29.0-51.el7, curl-debuginfo 7.29.0-51.el7 Red Hat Enterprise Linux ComputeNode (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7
    fixed: vendor fix RHSA-2018:3157
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) curl 7.29.0-46.el7_5.1, libcurl 7.29.0-46.el7_5.1
    fixed: vendor fix RHSA-2020:0544
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcurl-devel 7.29.0-51.el7, curl-debuginfo 7.29.0-51.el7
    fixed: vendor fix RHSA-2018:3157
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) libcurl-devel 7.29.0-46.el7_5.1, curl-debuginfo 7.29.0-46.el7_5.1
    fixed: vendor fix RHSA-2020:0544
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7 Red Hat Enterprise Linux Server (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7
    fixed: vendor fix RHSA-2018:3157
show 6 more
  • Red Hat Enterprise Linux Server AUS (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2 Red Hat Enterprise Linux Server E4S (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2
    fixed: vendor fix RHSA-2020:0594
  • Red Hat Enterprise Linux Server EUS (v. 7.5) curl 7.29.0-46.el7_5.1, libcurl 7.29.0-46.el7_5.1
    fixed: vendor fix RHSA-2020:0544
  • Red Hat Enterprise Linux Server TUS (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2
    fixed: vendor fix RHSA-2020:0594
  • Red Hat Enterprise Linux Workstation (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7
    fixed: vendor fix RHSA-2018:3157
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-curl 7.61.1-1.el6, httpd24-httpd 2.4.34-7.el6, httpd24-nghttp2 1.7.1-7.el6, httpd24-libcurl 7.61.1-1.el6, httpd24-mod_ssl 2.4.34-7.el6, httpd24-mod_ldap 2.4.34-7.el6, +5 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-curl 7.61.1-1.el6, httpd24-httpd 2.4.34-7.el6, httpd24-nghttp2 1.7.1-7.el6, httpd24-libcurl 7.61.1-1.el6, httpd24-mod_ssl 2.4.34-7.el6, httpd24-mod_ldap 2.4.34-7.el6, +5 more
    +1 more products
    Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more
    fixed: vendor fix RHSA-2018:3558
  • Red Hat Enterprise Linux 5 curl Red Hat Enterprise Linux 6 curl, libcurl Red Hat Enterprise Linux 8 curl, libcurl, libcurl-minimal
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-19-155-01 updated cvss 9.1

PHOENIX CONTACT PLCNext AXC F 2152

  • Phoenix Contact AXC F 2152 2404267 version 1.x, 1046568 (Starterkit) version 1.x
    affected: vendor fix, mitigation “Phoenix Contact recommends affected users update to firmware release 2019.0 LTS or later, update to PLCNext Engineer release 2019.0 LTS or later, and apply the following specific mitigations below:” phoenixcontact.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

9.04% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.