curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | May 29, 2018 | May 24, 2018 |
| Amazon Linux Ami 2 | — | Upgrade nss-pemUpgrade nss-pem-debuginfoUpgrade curl-debuginfoUpgrade libcurl-develUpgrade curlUpgrade libcurl | Apr 27, 2020 | May 24, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 24, 2018 |
| Centos_linux | — | Upgrade nss-pemUpgrade curlUpgrade nss-pem-debuginfoUpgrade libcurlUpgrade libcurl-develUpgrade curl-debuginfo | Aug 28, 2019 | May 24, 2018 |
| Debian | — | Upgrade curl | May 18, 2018 | May 16, 2018 |
| Freebsd | — | Upgrade curl | May 17, 2018 | May 16, 2018 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Jun 20, 2018 | May 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade curlUpgrade libcurlUpgrade libcurl-devel | Jul 3, 2018 | May 24, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libcurl-develUpgrade curlUpgrade libcurl | Jul 3, 2018 | May 24, 2018 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | May 24, 2018 |
| Oracle_linux | — | Upgrade curlUpgrade nss-pemUpgrade libcurl-develUpgrade libcurl | Nov 6, 2018 | May 16, 2018 |
| Redhat_linux | — | Upgrade nss-pemUpgrade libcurl-develUpgrade curlUpgrade curl-debuginfoUpgrade nss-pem-debuginfoUpgrade libcurl | Oct 31, 2018 | May 24, 2018 |
| Suse | — | Upgrade libcurl4-openssl1Upgrade libcurl4-miniUpgrade libcurl4-32bitUpgrade libcurl4-openssl1-x86Upgrade libcurl-develUpgrade curlUpgrade libcurl-devel-32bitUpgrade curl-openssl1Upgrade curl-miniUpgrade libcurl4Upgrade libcurl-mini-develUpgrade libcurl4-x86Upgrade libcurl4-openssl1-32bit | May 18, 2018 | May 16, 2018 |
| Ubuntu | — | Upgrade libcurl4Upgrade libcurl3Upgrade libcurl3-nssUpgrade curlUpgrade libcurl3-gnutls | May 23, 2018 | May 16, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub