CVE-2018-1000301 json
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can resu…
published 2018-05-24 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1896
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.8%
- EPSS 5.8% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
Patch / fix
- oracle communications_webrtc_session_controller 7.2
- curl Debian 14, Debian 13, Debian 12 7.60.0-1
debian advisories DEBIAN-CVE-2018-1000301
- curl Ubuntu 14.04 LTS 7.35.0-1ubuntu2.16
- curl Ubuntu 16.04 LTS 7.47.0-1ubuntu2.8
- curl Ubuntu 18.04 LTS 7.58.0-2ubuntu3.1
ubuntu advisories UBUNTU-CVE-2018-1000301
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- httpd24-curl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el6
- httpd24-curl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el7
- httpd24-httpd RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el6
- httpd24-httpd RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el7
- httpd24-mod_md RHEL 3 SOFTWARE_COLLECTIONS 2.4.34-7.el7
- httpd24-libcurl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el6
- httpd24-libcurl RHEL 3 SOFTWARE_COLLECTIONS 7.61.1-1.el7
- httpd24-mod_ssl RHEL 3 SOFTWARE_COLLECTIONS 1:2.4.34-7.el6
red hat advisories RHSA-2020:0594RHSA-2020:0544RHSA-2018:3558RHSA-2018:3157
- curl SLES 12 SP3, SLES 12 SP2-BCL, SLED 12 SP3 +9 more 7.37.0-37.23.1
- curl SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 7.37.0-70.30.1
- curl-openssl1 SLES 11-SECURITY 7.37.0-70.30.1
suse advisories SUSE-SU-2018:1327-2SUSE-SU-2018:1478-1SUSE-SU-2018:1327-1
- curl openSUSE Tumbleweed 7.79.1-1.1
opensuse advisories openSUSE-SU-2024:10582-1
- curl Alpine 3.24, Alpine 3.23, Alpine 3.22 +18 more 7.60.0-r0
alpine advisories ALPINE-CVE-2018-1000301
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-1000301 updated cvss 5.4
curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service
-
Red Hat .NET Core 1.0 on Red Hat Enterprise Linux rh-dotnetcore10-curl Red Hat .NET Core 1.1 on Red Hat Enterprise Linux rh-dotnetcore11-curl Red Hat .NET Core 2.0 on Red Hat Enterprise Linux rh-dotnet20-curlaffected: no fix planned “Out of support scope”
-
Red Hat .NET Core 2.1 on Red Hat Enterprise Linux rh-dotnet21-curl, rh-dotnet21-libcurl Red Hat JBoss Enterprise Web Server 3 curlaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux Client (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7 Red Hat Enterprise Linux Client Optional (v. 7) libcurl-devel 7.29.0-51.el7, curl-debuginfo 7.29.0-51.el7 Red Hat Enterprise Linux ComputeNode (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7fixed: vendor fix RHSA-2018:3157
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) curl 7.29.0-46.el7_5.1, libcurl 7.29.0-46.el7_5.1fixed: vendor fix RHSA-2020:0544
-
Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcurl-devel 7.29.0-51.el7, curl-debuginfo 7.29.0-51.el7fixed: vendor fix RHSA-2018:3157
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) libcurl-devel 7.29.0-46.el7_5.1, curl-debuginfo 7.29.0-46.el7_5.1fixed: vendor fix RHSA-2020:0544
-
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7 Red Hat Enterprise Linux Server (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7fixed: vendor fix RHSA-2018:3157
-
Red Hat Enterprise Linux Server AUS (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2 Red Hat Enterprise Linux Server E4S (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2fixed: vendor fix RHSA-2020:0594
show 5 moreshow fewer
-
Red Hat Enterprise Linux Server EUS (v. 7.5) curl 7.29.0-46.el7_5.1, libcurl 7.29.0-46.el7_5.1fixed: vendor fix RHSA-2020:0544
-
Red Hat Enterprise Linux Server TUS (v. 7.4) curl 7.29.0-42.el7_4.2, libcurl 7.29.0-42.el7_4.2fixed: vendor fix RHSA-2020:0594
-
Red Hat Enterprise Linux Workstation (v. 7) curl 7.29.0-51.el7, nss-pem 1.0.3-5.el7, libcurl 7.29.0-51.el7fixed: vendor fix RHSA-2018:3157
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-curl 7.61.1-1.el6, httpd24-httpd 2.4.34-7.el6, httpd24-nghttp2 1.7.1-7.el6, httpd24-libcurl 7.61.1-1.el6, httpd24-mod_ssl 2.4.34-7.el6, httpd24-mod_ldap 2.4.34-7.el6, +5 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-curl 7.61.1-1.el6, httpd24-httpd 2.4.34-7.el6, httpd24-nghttp2 1.7.1-7.el6, httpd24-libcurl 7.61.1-1.el6, httpd24-mod_ssl 2.4.34-7.el6, httpd24-mod_ldap 2.4.34-7.el6, +5 morefixed: vendor fix RHSA-2018:3558
+1 more productsfewer
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-curl 7.61.1-1.el7, httpd24-httpd 2.4.34-7.el7, httpd24-mod_md 2.4.34-7.el7, httpd24-nghttp2 1.7.1-7.el7, httpd24-libcurl 7.61.1-1.el7, httpd24-mod_ssl 2.4.34-7.el7, +6 more -
Red Hat Enterprise Linux 5 curl Red Hat Enterprise Linux 6 curl, libcurl Red Hat Enterprise Linux 8 curl, libcurl, libcurl-minimalnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-19-155-01 updated cvss 9.1
PHOENIX CONTACT PLCNext AXC F 2152
-
Phoenix Contact AXC F 2152 2404267 version 1.x, 1046568 (Starterkit) version 1.xaffected: vendor fix, mitigation “Phoenix Contact recommends affected users update to firmware release 2019.0 LTS or later, update to PLCNext Engineer release 2019.0 LTS or later, and apply the following specific mitigations below:” phoenixcontact.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
5.81% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVD | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P |
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
oracle.com
/technetwork/security-advisory/cpujul2018-4258247.html
patch
-
oracle.com
/technetwork/security-advisory/cpujan2019-5072801.html
patch, third-party-advisory
-
curl.haxx.se
/docs/adv_2018-b138.html
patch, vendor-advisory
-
oracle.com
/technetwork/security-advisory/cpuoct2018-4428296.html
patch
-
access.redhat.com
/errata/RHSA-2018:3558
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:3157
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/201806-05
vendor-advisory, third-party-advisory
-
debian.org
/security/2018/dsa-4202
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3648-1/
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3598-2/
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHBA-2019:0327
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2020:0544
vendor-advisory
-
access.redhat.com
/errata/RHSA-2020:0594
vendor-advisory
-
securityfocus.com
/bid/104225
vdb-entry, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2018/05/msg00010.html
mailing-list, third-party-advisory
-
securitytracker.com
/id/1040931
vdb-entry, third-party-advisory
- oracle.com /technetwork/security-advisory/cpujul2019-5072835.html
Sources
- CVE List CVE-2018-1000301
- NVD CVE-2018-1000301
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.