A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-curl | Mar 21, 2018 | Mar 14, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-curl | Apr 20, 2018 | Mar 14, 2018 |
| Centos_linux | — | centos-upgrade-curlcentos-upgrade-curl-debuginfocentos-upgrade-libcurlcentos-upgrade-libcurl-develcentos-upgrade-nss-pemcentos-upgrade-nss-pem-debuginfo | Aug 28, 2019 | Mar 14, 2018 |
| Redhat_linux | — | redhat-upgrade-curlredhat-upgrade-curl-debuginforedhat-upgrade-libcurlredhat-upgrade-libcurl-develredhat-upgrade-nss-pemredhat-upgrade-nss-pem-debuginfo | Oct 31, 2018 | Mar 14, 2018 |
| Suse | — | suse-upgrade-curlsuse-upgrade-curl-openssl1suse-upgrade-libcurl-develsuse-upgrade-libcurl4suse-upgrade-libcurl4-32bitsuse-upgrade-libcurl4-openssl1suse-upgrade-libcurl4-openssl1-32bitsuse-upgrade-libcurl4-openssl1-x86suse-upgrade-libcurl4-x86 | Mar 23, 2018 | Mar 14, 2018 |
| Ubuntu | ubuntu-upgrade-curlubuntu-upgrade-libcurl3ubuntu-upgrade-libcurl3-gnutlsubuntu-upgrade-libcurl3-nss | Apr 25, 2018 | Mar 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub