USN-3648-1

Dashboard / Vulnerabilities / USN-3648-1

USN-3648-1

Summary: curl vulnerabilities

Details: Dario Weisser discovered that curl incorrectly handled long FTP server command replies. If a user or automated system were tricked into connecting to a malicious FTP server, a remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-1000300) Max Dymond discovered that curl incorrectly handled certain RTSP responses. If a user or automated system were tricked into connecting to a malicious server, a remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2018-1000301)

References: https://ubuntu.com/security/notices/USN-3648-1, https://ubuntu.com/security/CVE-2018-1000300, https://ubuntu.com/security/CVE-2018-1000301