{"id":"CURL-CVE-2018-1000300","summary":"FTP shutdown response buffer overflow","details":"curl might overflow a heap based memory buffer when closing down an FTP\nconnection with long server command replies.\n\nWhen doing FTP transfers, curl keeps a spare \"closure handle\" around\ninternally that is used when an FTP connection gets shut down since the\noriginal curl easy handle is then already removed.\n\nFTP server response data that gets cached from the original transfer might\nthen be larger than the default buffer size (16 KB) allocated in the \"closure\nhandle\", which can lead to a buffer overwrite. The contents and size of that\noverwrite is controllable by the server.\n\nThis situation was detected by an assert() in the code, but that was of course\nonly preventing bad stuff in debug builds. This bug is highly unlikely\nto trigger with non-malicious servers.","aliases":["CVE-2018-1000300"],"modified":"2025-11-12T00:50:45Z","published":"2018-05-16T08:00:00Z","database_specific":{"last_affected":"7.59.0","CWE":{"id":"CWE-122","desc":"Heap-based Buffer Overflow"},"URL":"https://curl.se/docs/CVE-2018-1000300.json","www":"https://curl.se/docs/CVE-2018-1000300.html","severity":"High","affects":"both","package":"curl"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"7.54.1"},{"fixed":"7.60.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"e40e9d7f0decc799e3ccfe2c418632f8bb52031a"},{"fixed":"583b42cb3b809b1bf597af160468ccba728c2248"}]}],"versions":["7.59.0","7.58.0","7.57.0","7.56.1","7.56.0","7.55.1","7.55.0","7.54.1"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2018-1000300.json","vanir_signatures":[{"id":"CURL-CVE-2018-1000300-0a45ae05","deprecated":false,"signature_type":"Line","signature_version":"v1","digest":{"line_hashes":["229758711889692930654527470441779275027","220322334328261129743823848021469509886","296596693923419492886215170191994352530","36235404738579012465951377492501113291"],"threshold":0.9},"target":{"file":"lib/pingpong.c"},"source":"https://github.com/curl/curl.git/commit/583b42cb3b809b1bf597af160468ccba728c2248"},{"id":"CURL-CVE-2018-1000300-80deae81","deprecated":false,"signature_type":"Function","signature_version":"v1","digest":{"function_hash":"213018455658973195550019192185324775648","length":3224},"target":{"file":"lib/pingpong.c","function":"Curl_pp_readresp"},"source":"https://github.com/curl/curl.git/commit/583b42cb3b809b1bf597af160468ccba728c2248"}]}}],"schema_version":"1.7.3","credits":[{"name":"Dario Weisser","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}