CVE-2018-1000300: canonical ubuntu_linux Out-of-bounds Write
Vulnerability summary
CVE-2018-1000300 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 4.70% chance of exploitation in the next 30 days, higher than 91.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 24-05-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
4.70%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
-0.10 pp
From 4.80% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- curl≥ 7.54.1, < 7.60.0-r0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10 | 18.04
Debian1 product
- curl< 7.60.0-1
Haxx1 product
- curl≥ 7.54.1, ≤ 7.59.0
Ubuntu1 product
- curl< 7.58.0-2ubuntu3.1
5 vendors · 5 products
