curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade curl | May 29, 2018 | May 24, 2018 |
| Amazon Linux Ami 2 | — | Upgrade curl-debuginfoUpgrade libcurl-develUpgrade nss-pem-debuginfoUpgrade libcurlUpgrade curlUpgrade nss-pem | Apr 27, 2020 | May 24, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 24, 2018 |
| Centos_linux | — | Upgrade nss-pemUpgrade curl-debuginfoUpgrade libcurlUpgrade nss-pem-debuginfo | Aug 28, 2019 | May 24, 2018 |
| Debian | — | Upgrade curl | May 18, 2018 | May 16, 2018 |
| Freebsd | — | Upgrade curl | May 17, 2018 | May 16, 2018 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Jun 20, 2018 | May 24, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libcurlUpgrade libcurl-develUpgrade curl | Jul 3, 2018 | May 24, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libcurl-develUpgrade curlUpgrade libcurl | Jul 3, 2018 | May 24, 2018 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | May 24, 2018 |
| Oracle_linux | — | Upgrade libcurlUpgrade libcurl-develUpgrade nss-pemUpgrade curl | Nov 6, 2018 | May 16, 2018 |
| Redhat_linux | — | Upgrade nss-pemUpgrade libcurlUpgrade libcurl-develUpgrade curlUpgrade curl-debuginfoUpgrade nss-pem-debuginfo | Oct 31, 2018 | May 24, 2018 |
| Suse | — | Upgrade libcurl4Upgrade curl-openssl1Upgrade libcurl4-x86Upgrade libcurl4-openssl1-32bitUpgrade libcurl-mini-develUpgrade curl-miniUpgrade libcurl4-openssl1-x86Upgrade libcurl4-openssl1Upgrade libcurl4-miniUpgrade libcurl-develUpgrade libcurl-devel-32bitUpgrade curlUpgrade libcurl4-32bit | May 18, 2018 | May 16, 2018 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade curlUpgrade libcurl3-nssUpgrade libcurl3Upgrade libcurl4 | May 23, 2018 | May 16, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub