CVE-2018-1126 procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
CriticalCVSS 9.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/procps(Debian:12) | < 2:3.3.15-1 | 2:3.3.15-1 |
| debian/procps(Debian:13) | < 2:3.3.15-1 | 2:3.3.15-1 |
| debian/procps(Debian:14) | < 2:3.3.15-1 | 2:3.3.15-1 |
| procps-ng project procps-ng | < 3.3.15 | 3.3.15 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.5 | No fix listed |
| redhat enterprise linux server aus | = 6.6 | No fix listed |
| redhat enterprise linux server tus | = 6.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| schneider-electric struxureware data center expert | < 7.6.0 | 7.6.0 |
| [UNKNOWN] procps-ng, procps | = procps-ng 3.3.15 | No fix listed |
References
- Debian Security Tracker CVE-2018-1126 vendor-advisory
- openSUSE-SU-2019:2376 vendor-advisory
- openSUSE-SU-2019:2379 vendor-advisory
- [oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report mailing-list third-party-advisory
- 104214 third-party-advisory vdb-entry
- 1041057 third-party-advisory vdb-entry
- RHSA-2018:1700 third-party-advisory vendor-advisory
- RHSA-2018:1777 third-party-advisory vendor-advisory
- RHSA-2018:1820 third-party-advisory vendor-advisory
- RHSA-2018:2267 third-party-advisory vendor-advisory
- RHSA-2018:2268 third-party-advisory vendor-advisory
- RHSA-2019:1944 vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- help.ecostruxureit.com third-party-advisory
- [debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update mailing-list third-party-advisory
- USN-3658-1 third-party-advisory vendor-advisory
- USN-3658-2 third-party-advisory vendor-advisory
- DSA-4208 third-party-advisory vendor-advisory
- www.qualys.com exploit third-party-advisory
- bugs.debian.org issue-tracking