Red Hat Security Advisory: curl and nss-pem security and bug fix update

Fixed packages 24

Vulnerabilities 5

• Critical 9.8
  CVE-2018-1000120 EPSS 12%

  curl FTP path confusion leads to NIL byte out of bounds write

  A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.

  curl curl curl curl Debian Ubuntu Alpine NuGet
  Mar 14, 2018
• Critical 9.1
  CVE-2018-1000301

  curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…

  curl curl curl Debian Ubuntu Alpine
  May 24, 2018
• Unscored —
  CVE-2018-1000007

  libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom head…

  curl curl Debian Ubuntu
  Jan 24, 2018
• Unscored —
  CVE-2018-1000121

  A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker …

  curl curl curl Debian Ubuntu Alpine
  Mar 14, 2018
• Unscored —
  CVE-2018-1000122

  A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an atta…

  curl curl curl Debian Ubuntu Alpine
  Mar 14, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1510247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1537125
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1542256
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1552628
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1552631
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1553398
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1575536
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1610998
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3157.json
• report
  https://access.redhat.com/security/cve/CVE-2018-1000007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000007
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000007
• article
  https://curl.haxx.se/docs/adv_2018-b3bf.html
• report
  https://access.redhat.com/security/cve/CVE-2018-1000120
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000120
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000120
• article
  https://curl.haxx.se/docs/adv_2018-9cd6.html
• report
  https://access.redhat.com/security/cve/CVE-2018-1000121
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000121
• article
  https://curl.haxx.se/docs/adv_2018-97a2.html
• report
  https://access.redhat.com/security/cve/CVE-2018-1000122
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000122
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000122
• article
  https://curl.haxx.se/docs/adv_2018-b047.html
• report
  https://access.redhat.com/security/cve/CVE-2018-1000301
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000301
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000301
• article
  https://curl.haxx.se/docs/adv_2018-b138.html