WaratekVRT Sign in

CVE-2018-1000120 curl

Affected softwarecurl
Severity9.8 Critical CVSS 3.0 2 scores
WeaknessOut-of-bounds write (CWE-787)
Published14 Mar 2018
Updated17 Jun 2026

Description

A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 8 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 12% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2019 ↗ CPU 2019-Q3 Oracle Communications Applications / Security (cURL) (3.7.1, 3.8.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications Security (cURL) 3.7.1, 3.8.0 3.7.1 · 3.8.0

Products and versions

9 products, 17 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 12.04 · 14.04 · 16.04 · 17.10
nvd debian debian linux generic 7.0 · 8.0 · 9.0
nvd haxx curl generic ≥ 7.12.3 and ≤ 7.58.0
nvd oracle communications webrtc session controller generic ＜ 7.2
nvd oracle enterprise manager ops center generic 12.2.2 · 12.3.3
nvd oracle peoplesoft enterprise peopletools generic 8.55 · 8.56 · 8.57
nvd redhat enterprise linux desktop generic 7.0
nvd redhat enterprise linux server generic 7.0
nvd redhat enterprise linux workstation generic 7.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, SECURITY (CURL), NO AUTH REMOTE EXPLOIT **Products:** ORACLE COMMUNICATIONS APPLICATIONS, ORACLE COMMUNICATIONS APPLICATION SESSION CONTROLLER, CURL

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch
http://www.securityfocus.com/bid/103414 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040531 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3157 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3558 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1543
https://access.redhat.com/errata/RHSA-2020:0544
https://access.redhat.com/errata/RHSA-2020:0594

Timeline
Published2018-03-14By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.