curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | May 29, 2018 | May 24, 2018 |
| Amazon Linux Ami 2 | — | Upgrade curl-debuginfoUpgrade curlUpgrade libcurlUpgrade nss-pem-debuginfoUpgrade libcurl-develUpgrade nss-pem | Apr 27, 2020 | May 24, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 24, 2018 |
| Centos_linux | — | Upgrade libcurl-develUpgrade libcurlUpgrade curl | Aug 28, 2019 | May 24, 2018 |
| Debian | — | Upgrade curl | May 18, 2018 | May 16, 2018 |
| Freebsd | — | Upgrade curl | May 17, 2018 | May 16, 2018 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Jun 20, 2018 | May 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl | Jul 3, 2018 | May 24, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurl | Jul 3, 2018 | May 24, 2018 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | May 24, 2018 |
| Oracle_linux | — | Upgrade libcurlUpgrade nss-pemUpgrade libcurl-develUpgrade curl | Nov 6, 2018 | May 16, 2018 |
| Redhat_linux | — | Upgrade curlUpgrade libcurlUpgrade curl-debuginfoUpgrade nss-pem-debuginfoUpgrade libcurl-develUpgrade nss-pem | Oct 31, 2018 | May 24, 2018 |
| Suse | — | Upgrade libcurl4-openssl1-32bitUpgrade libcurl-mini-develUpgrade curl-miniUpgrade libcurl4-x86Upgrade curl-openssl1Upgrade libcurl4Upgrade curlUpgrade libcurl4-openssl1Upgrade libcurl4-miniUpgrade libcurl4-32bitUpgrade libcurl4-openssl1-x86Upgrade libcurl-devel-32bitUpgrade libcurl-devel | May 18, 2018 | May 16, 2018 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade curlUpgrade libcurl4Upgrade libcurl3Upgrade libcurl3-nss | May 23, 2018 | May 16, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub