CVE-2018-16842
Severity CVSS v4.0:
Pending analysis
Type:
CWE-125
Out-of-bounds Read
Publication date:
31/10/2018
Last modified:
06/08/2019
Description
Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.
Impact
Base Score 3.x
9.10
Severity 3.x
CRITICAL
Base Score 2.0
6.40
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* | 7.14.1 (including) | 7.61.1 (including) |
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | ||
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | ||
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | ||
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | ||
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://www.securitytracker.com/id/1042014
- https://access.redhat.com/errata/RHSA-2019:2181
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16842
- https://curl.haxx.se/docs/CVE-2018-16842.html
- https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211
- https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html
- https://security.gentoo.org/glsa/201903-03
- https://usn.ubuntu.com/3805-1/
- https://usn.ubuntu.com/3805-2/
- https://www.debian.org/security/2018/dsa-4331
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html