curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | May 29, 2018 | May 24, 2018 |
| Amazon Linux Ami 2 | — | Upgrade libcurlUpgrade curlUpgrade nss-pem-debuginfoUpgrade libcurl-develUpgrade curl-debuginfoUpgrade nss-pem | Apr 27, 2020 | May 24, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 24, 2018 |
| Centos_linux | — | Upgrade nss-pemUpgrade curlUpgrade curl-debuginfoUpgrade libcurlUpgrade nss-pem-debuginfoUpgrade libcurl-devel | Aug 28, 2019 | May 24, 2018 |
| Debian | — | Upgrade curl | May 18, 2018 | May 16, 2018 |
| Freebsd | — | Upgrade curl | May 17, 2018 | May 16, 2018 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Jun 20, 2018 | May 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade curlUpgrade libcurlUpgrade libcurl-devel | Jul 3, 2018 | May 24, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-devel | Jul 3, 2018 | May 24, 2018 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | May 24, 2018 |
| Oracle_linux | — | Upgrade libcurlUpgrade curlUpgrade libcurl-develUpgrade nss-pem | Nov 6, 2018 | May 16, 2018 |
| Redhat_linux | — | Upgrade nss-pemUpgrade nss-pem-debuginfoUpgrade libcurl-develUpgrade libcurlUpgrade curl-debuginfoUpgrade curl | Oct 31, 2018 | May 24, 2018 |
| Suse | — | Upgrade curl-miniUpgrade curl-openssl1Upgrade libcurl4-x86Upgrade libcurl-mini-develUpgrade libcurl4Upgrade libcurl4-openssl1-32bitUpgrade libcurl-devel-32bitUpgrade libcurl4-openssl1Upgrade libcurl4-miniUpgrade libcurl4-32bitUpgrade libcurl4-openssl1-x86Upgrade curlUpgrade libcurl-devel | May 18, 2018 | May 16, 2018 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade curlUpgrade libcurl3Upgrade libcurl3-nssUpgrade libcurl4 | May 23, 2018 | May 16, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub