VYPR
← All advisories
Critical severityNVD Advisory· Published Mar 14, 2018· Updated Aug 5, 2024

CVE-2018-1000120

CVE-2018-1000120

Description

A buffer overflow in curl's FTP URL handling (7.12.3 through 7.58.0) allows attackers to cause denial of service or potentially execute arbitrary code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A buffer overflow in curl's FTP URL handling (7.12.3 through 7.58.0) allows attackers to cause denial of service or potentially execute arbitrary code.

Vulnerability

A buffer overflow vulnerability exists in curl versions 7.12.3 through and including 7.58.0 in the FTP URL handling code. The flaw occurs when curl processes specially crafted FTP URLs, leading to an out-of-bounds write via a NUL byte overflow. The affected versions are those listed in the description and confirmed by Red Hat errata [1][2].

Exploitation

An attacker must be able to make a victim or automated process using curl (or libcurl) connect to a malicious FTP server, or inject a crafted FTP URL into a request. No special privileges or authentication are required beyond network access to trigger the vulnerability. The attacker controls the FTP path to induce a NIL byte out-of-bounds write [2].

Impact

Successful exploitation can cause a denial of service (crash) due to the buffer overflow, or potentially lead to arbitrary code execution depending on the memory layout and mitigations. The CVSS base score provided by Red Hat is moderate, indicating the risk of information disclosure, crashes, or code execution under certain conditions [2].

Mitigation

Red Hat released patched versions of curl for Red Hat Enterprise Linux 7 (via RHSA-2018:3157) and for Red Hat Software Collections (via RHSA-2018:3558) that update curl to version 7.61.1 or later, which includes the fix [1][2]. Users should upgrade to the fixed curl version or apply the relevant patches. No workarounds are documented in the available references.

References
  1. https://access.redhat.com/errata/RHSA-2018:3558
  2. https://access.redhat.com/errata/RHSA-2018:3157

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
curlNuGet
>= 7.12.3—

Affected products

21

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

25

News mentions

0

No linked articles in our index yet.