What’s Vulnerable › Vulnerabilities
CVE-2018-1000120
- Severity: critical (CVSS 9.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 11.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-03-14 · updated 2026-06-17
- Weakness: CWE-787
Description
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 17.10
- Debian Linux: 7.0, 8.0, 9.0
- curl: from 7.12.3 through 7.58.0
- Oracle Corporation Communications WebRTC Session Controller: before 7.2 — fixed in 7.2
- Oracle Corporation Enterprise Manager Ops Center: 12.2.2, 12.3.3
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.55, 8.56, 8.57
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Workstation: 7.0
How to fix
Upgrade to a fixed version: Oracle Corporation Communications WebRTC Session Controller 7.2. Check the vendor advisory for mitigations.
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/103414
- http://www.securitytracker.com/id/1040531
- https://access.redhat.com/errata/RHBA-2019:0327
- https://access.redhat.com/errata/RHSA-2018:3157
- https://access.redhat.com/errata/RHSA-2018:3558
- https://access.redhat.com/errata/RHSA-2019:1543
- https://access.redhat.com/errata/RHSA-2020:0544
- https://access.redhat.com/errata/RHSA-2020:0594
- https://curl.haxx.se/docs/adv_2018-9cd6.html
- https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html
Get alerted when CVE-2018-1000120 or the next vulnerability affects your stack