critical
CVE-2018-1000120
curl: FTP path trickery leads to NIL byte out of bounds write
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.4CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Photon OS. Rated lower by Red Hat (medium), Amazon (medium), Oracle (medium), Ubuntu (medium).
Description
A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| nuget::GitHub Security Advisory NuGet | curl | no fix listed |
| Photon OS 1.0 | curl | 7.59.0-1.ph1 |
| alpine 3.10 | curl | 7.59.0-r0 |
| alpine 3.11 | curl | 7.59.0-r0 |
| alpine 3.12 | curl | 7.59.0-r0 |
| alpine 3.13 | curl | 7.59.0-r0 |
| alpine 3.14 | curl | 7.59.0-r0 |
| alpine 3.15 | curl | 7.59.0-r0 |
| alpine 3.16 | curl | 7.59.0-r0 |
| alpine 3.17 | curl | 7.59.0-r0 |
| alpine 3.18 | curl | 7.59.0-r0 |
| alpine 3.19 | curl | 7.59.0-r0 |
Show all 62 entries from 46 sources
| Source | Package | Fixed in |
|---|---|---|
| nuget::GitHub Security Advisory NuGet | curl | no fix listed |
| Photon OS 1.0 | curl | 7.59.0-1.ph1 |
| alpine 3.10 | curl | 7.59.0-r0 |
| alpine 3.11 | curl | 7.59.0-r0 |
| alpine 3.12 | curl | 7.59.0-r0 |
| alpine 3.13 | curl | 7.59.0-r0 |
| alpine 3.14 | curl | 7.59.0-r0 |
| alpine 3.15 | curl | 7.59.0-r0 |
| alpine 3.16 | curl | 7.59.0-r0 |
| alpine 3.17 | curl | 7.59.0-r0 |
| alpine 3.18 | curl | 7.59.0-r0 |
| alpine 3.19 | curl | 7.59.0-r0 |
| alpine 3.20 | curl | 7.59.0-r0 |
| alpine 3.21 | curl | 7.59.0-r0 |
| alpine 3.22 | curl | 7.59.0-r0 |
| alpine 3.23 | curl | 7.59.0-r0 |
| alpine 3.24 | curl | 7.59.0-r0 |
| alpine 3.4 | curl | 7.59.0-r0 |
| alpine 3.5 | curl | 7.59.0-r0 |
| alpine 3.6 | curl | 7.59.0-r0 |
| alpine 3.7 | curl | 7.59.0-r0 |
| alpine 3.8 | curl | 7.59.0-r0 |
| alpine 3.9 | curl | 7.59.0-r0 |
| alpine edge | curl | 7.59.0-r0 |
| amazon linux 1 | curl | 7.53.1-16.84.amzn1 |
| amazon linux 1 | curl-debuginfo | 7.53.1-16.84.amzn1 |
| amazon linux 1 | libcurl | 7.53.1-16.84.amzn1 |
| amazon linux 1 | libcurl-devel | 7.53.1-16.84.amzn1 |
| amazon linux 2 | curl | 7.55.1-10.amzn2.0.1 |
| amazon linux 2 | curl-debuginfo | 7.55.1-10.amzn2.0.1 |
| amazon linux 2 | libcurl | 7.55.1-10.amzn2.0.1 |
| amazon linux 2 | libcurl-devel | 7.55.1-10.amzn2.0.1 |
| amazon linux 2 | nss-pem | 1.0.3-5.amzn2 |
| amazon linux 2 | nss-pem-debuginfo | 1.0.3-5.amzn2 |
| debian 11 | curl | 7.60.0-1 |
| debian 12 | curl | 7.60.0-1 |
| debian 13 | curl | 7.60.0-1 |
| debian 14 | curl | 7.60.0-1 |
| debian 7 | curl | 7.26.0-1+wheezy25 |
| debian 8 | curl | 7.38.0-4+deb8u10 |
| debian 9 | curl | 7.52.1-5+deb9u5 |
| echo | curl | 7.60.0-1 |
| Oracle Linux 7 | curl | 7.29.0-51.el7 |
| Oracle Linux 7 | libcurl | 7.29.0-51.el7 |
| Oracle Linux 7 | libcurl-devel | 7.29.0-51.el7 |
| Oracle Linux 7 | nss-pem | 1.0.3-5.el7 |
| Red Hat | curl | no fix listed |
| Red Hat | libcurl | no fix listed |
| Red Hat | libcurl-devel | no fix listed |
| Red Hat | rh-dotnet21-curl | no fix listed |
| Red Hat | rh-dotnet21-libcurl | no fix listed |
| Red Hat | rh-dotnet21-libcurl-devel | no fix listed |
| root.io debian 11 | rootio-curl | 7.60.0-1 |
| root.io debian 12 | rootio-curl | 7.60.0-1 |
| root.io debian 13 | rootio-curl | 7.60.0-1 |
| ubuntu 14.04 | curl | 7.35.0-1ubuntu2.15 |
| ubuntu 14.04-ESM | curl | 7.35.0-1ubuntu2.15 |
| ubuntu 16.04 | curl | 7.47.0-1ubuntu2.7 |
| ubuntu 16.04-ESM | curl | 7.47.0-1ubuntu2.7 |
| ubuntu 17.10 | curl | 7.55.1-1ubuntu2.4 |
| ubuntu 18.04 | curl | 7.58.0-2ubuntu3 |
| ubuntu 18.04-ESM | curl | 7.58.0-2ubuntu3 |
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/103414
- http://www.securitytracker.com/id/1040531
- https://access.redhat.com/errata/RHBA-2019:0327
- https://access.redhat.com/errata/RHSA-2018:3157
- https://access.redhat.com/errata/RHSA-2018:3558
- https://access.redhat.com/errata/RHSA-2019:1543
All 31 references
- https://access.redhat.com/errata/RHSA-2020:0544
- https://access.redhat.com/errata/RHSA-2020:0594
- https://access.redhat.com/security/cve/CVE-2018-1000120
- https://curl.haxx.se/docs/adv_2018-9cd6.html
- https://curl.se/docs/CVE-2018-1000120.html
- https://github.com/coapp-packages/curl
- https://linux.oracle.com/cve/CVE-2018-1000120.html
- https://linux.oracle.com/errata/ELSA-2018-3157.html
- https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000120
- https://ubuntu.com/security/notices/USN-3598-1
- https://ubuntu.com/security/notices/USN-3598-2
- https://usn.ubuntu.com/3598-1
- https://usn.ubuntu.com/3598-1/
- https://usn.ubuntu.com/3598-2
- https://usn.ubuntu.com/3598-2/
- https://web.archive.org/web/20201220134105/http://www.securitytracker.com/id/1040531
- https://web.archive.org/web/20201220134609/http://www.securityfocus.com/bid/103414
- https://www.cve.org/CVERecord?id=CVE-2018-1000120
- https://www.debian.org/security/2018/dsa-4136
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html