libcurl.so is vulnerable to buffer over-read. There is a flaw in the application when reading RTSP responses, if there are no headers in the RTSP responses the library reads beyond the buffer, leading to the reading of sensitive information beyond the buffer or to the application crashing
www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
www.securityfocus.com/bid/104225
www.securitytracker.com/id/1040931
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index
access.redhat.com/errata/RHBA-2019:0327
access.redhat.com/errata/RHSA-2018:3157
access.redhat.com/errata/RHSA-2018:3558
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=1510247
bugzilla.redhat.com/show_bug.cgi?id=1542256
bugzilla.redhat.com/show_bug.cgi?id=1610998
curl.haxx.se/docs/adv_2018-b138.html
lists.debian.org/debian-lts-announce/2018/05/msg00010.html
security.gentoo.org/glsa/201806-05
usn.ubuntu.com/3598-2/
usn.ubuntu.com/3648-1/
www.debian.org/security/2018/dsa-4202
www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html