CVE-2018-1126

Published: May 23, 2018Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.

Affected (16)

Products: Procps Ng Project: Procps Ng · Canonical: Ubuntu Linux · Debian: Debian Linux · +2 more

Show all products

Procps Ng Project: Procps Ng · Canonical: Ubuntu Linux · Debian: Debian Linux · Redhat: Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Tus, Enterprise Linux Workstation · Schneider Electric: Struxureware Data Center Expert

1 product

1 product

1 product

6 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Schneider Electric

1 product

Struxureware Data Center Expert

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Procps Ng Project Procps Ng	Before 3.3.15

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 17.10
Canonical Ubuntu Linux	Version 18.04

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server	Version 7.5
Redhat Enterprise Linux Server Aus	Version 6.6
Redhat Enterprise Linux Server Tus	Version 6.6
Redhat Enterprise Linux Workstation	Version 7.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Schneider Electric Struxureware Data Center Expert	Before 7.6.0

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (36)

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html

Source: secalert@redhat.com

http://seclists.org/oss-sec/2018/q2/122

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/104214

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1041057

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:1700

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1777

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1820

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2267

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2268

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:1944

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0

Source: secalert@redhat.com

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/3658-1/

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/3658-2/

Source: secalert@redhat.com

Third Party Advisory

https://www.debian.org/security/2018/dsa-4208

Source: secalert@redhat.com

Third Party Advisory

https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt

Source: secalert@redhat.com

ExploitThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html