Red Hat Bugzilla – Bug 1553398
CVE-2018-1000122 curl: RTSP RTP buffer over-read
Last modified: 2018-10-30 03:43:39 EDT
curl can be tricked into copying data beyond end of its heap based buffer. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it didn't cause a crash). We've managed to get it to reach several hundreds bytes out of range. This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this.
Created attachment 1405982 [details] upstream patch
Acknowledgments: Name: the Curl project Upstream: Max Dymond
External References: https://curl.haxx.se/docs/adv_2018-b047.html
Created mingw-curl tracking bugs for this issue: Affects: fedora-all [bug 1555207] Created curl tracking bugs for this issue: Affects: fedora-all [bug 1555209] Created mingw-curl tracking bugs for this issue: Affects: epel-7 [bug 1555208]
Upstream fix: readwrite: make sure excess reads don't go beyond buffer end https://github.com/curl/curl/commit/d52dc4760f
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:3157 https://access.redhat.com/errata/RHSA-2018:3157