CVE-2018-16842: Canonical Ubuntu Linux

Critical severity, CVSS 9.1. EPSS: 2.1% chance of exploitation in the next 30 days.

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Haxx Curl: from 7.14.1, up to and including 7.61.1

Published 2018-10-31. Last modified 2026-06-17.