CVE-2018-1000300

Published: 16 May 2018

curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
curl
Launchpad, Ubuntu, Debian
Upstream
Released (7.60.0)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (7.58.0-2ubuntu3.1)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(7.47.0-1ubuntu2.7)
Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(7.35.0-1ubuntu2.15)

Notes

AuthorNote
mdeslaur
curl 7.54.1 to and including curl 7.59.0
introduced by https://github.com/curl/curl/commit/e40e9d7f0decc79

References