CVE-2018-1000301

Severity: critical (CVSS 9.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-24 · updated 2026-06-17
Weakness: CWE-125

Description

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 17.10, 18.04
Debian Linux: 7.0, 8.0, 9.0
curl: from 7.20.0 through 7.59.0
Oracle Corporation Communications WebRTC Session Controller: before 7.2 — fixed in 7.2
Oracle Corporation Enterprise Manager Ops Center: 12.2.2, 12.3.3
Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.55, 8.56, 8.57
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Server: 7.0
RedHat Enterprise Linux Workstation: 7.0

How to fix

Upgrade to a fixed version: Oracle Corporation Communications WebRTC Session Controller 7.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-1000301 or the next vulnerability affects your stack