Summary
Dario Weisser discovered that curl incorrectly handled long FTP server
command replies. If a user or automated system were tricked into connecting
to a malicious FTP server, a remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS.
(CVE-2018-1000300)
Max Dymond discovered that curl incorrectly handled certain RTSP responses.
If a user or automated system were tricked into connecting to a malicious
server, a remote attacker could use this issue to cause curl to crash,
resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2018-1000301)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | curl | 7.35.0-1ubuntu2.16 |
| Ubuntu · 16.04 LTS 16.04:LTS | curl | 7.47.0-1ubuntu2.8 |
| Ubuntu · 18.04 LTS 18.04:LTS | curl | 7.58.0-2ubuntu3.1 |
Vulnerabilities 2
-
Critical 9.1
curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…
-
Unscored —
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in d…