Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-5367 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/wpglobus.md - https://wpvulndb.com/vulnerabilities/9003
CVE ID: CVE-2018-5368 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9004 - https://github.com/d4wner/Vulnerabilities-Report/blob/master/SrbTransLatin.md
CVE ID: CVE-2018-5369 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9004 - https://github.com/d4wner/Vulnerabilities-Report/blob/master/SrbTransLatin.md
CVE ID: CVE-2018-5370 State: PUBLISHED Published: 2018-01-16T19:00:00 Last Updated: 2024-08-05T05:33:44.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43535/ - http://packetstormsecurity.com/files/145872/Xnami-Image-Sharing-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2018-5371 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: diag_ping.cmd on D-Link DSL-2640U devices with firmware IM_1.00 and ME_1.00, and DSL-2540U devices with firmware ME_1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request. Additional Analyst Notes: - CVE Program Container: References: - https://www.iplantom.com/2018/01/10/dsl2640U/
CVE ID: CVE-2018-5372 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Testimonial Slider plugin through 1.2.4 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter). Additional Analyst Notes: - CVE Program Container: References: - http://www.defensecode.com/advisories/DC-2018-01-005_WordPress_Testimonial_Slider_Plugin_Advisory.pdf
CVE ID: CVE-2018-5373 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Smooth Slider plugin through 2.8.6 for WordPress has SQL Injection via smooth-slider.php (trid parameter). Additional Analyst Notes: - CVE Program Container: References: - http://www.defensecode.com/advisories/DC-2018-01-004_WordPress_Smooth_Slider_Plugin_Advisory.pdf
CVE ID: CVE-2018-5374 State: PUBLISHED Published: 2018-01-12T09:00:00 Last Updated: 2024-08-05T05:33:44.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dbox 3D Slider Lite plugin through 1.2.2 for WordPress has SQL Injection via settings\sliders.php (current_slider_id parameter). Additional Analyst Notes: - CVE Program Container: References: - http://www.defensecode.com/advisories/DC-2017-01-003_WordPress_Dbox_3D_Slider_Lite_Plugin_Advisory.pdf
CVE ID: CVE-2018-5375 State: PUBLISHED Published: 2018-01-12T09:00:00Z Last Updated: 2024-09-17T01:41:40.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_space.php appid parameter in a delete action. Additional Analyst Notes: - CVE Program Container: References: - http://www.whsgwl.net/text.php?textid=34
CVE ID: CVE-2018-5376 State: PUBLISHED Published: 2018-01-12T09:00:00Z Last Updated: 2024-09-17T00:32:20.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_upload.php op parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.whsgwl.net/text.php?textid=35
CVE ID: CVE-2018-5377 State: PUBLISHED Published: 2018-01-12T09:00:00Z Last Updated: 2024-09-16T19:00:39.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.whsgwl.net/text.php?textid=36
CVE ID: CVE-2018-5378 State: PUBLISHED Published: 2018-02-19T13:00:00Z Last Updated: 2024-09-16T20:16:44.677Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) Vendors: Quagga Products: bgpd Problem Types: CWE-119 Description: The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and/or bgpd may crash. Additional Analyst Notes: - CVE Program Container: References: - https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-0543.txt - https://usn.ubuntu.com/3573-1/ - https://www.d
s.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-0543.txt - https://usn.ubuntu.com/3573-1/ - https://www.debian.org/security/2018/dsa-4115 - http://savannah.nongnu.org/forum/forum.php?forum_id=9095 - https://security.gentoo.org/glsa/201804-17 - http://www.kb.cert.org/vuls/id/940439
CVE ID: CVE-2018-5379 State: PUBLISHED Published: 2018-02-19T13:00:00Z Last Updated: 2024-09-17T03:22:36.451Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Quagga Products: bgpd Problem Types: CWE-415 Description: The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3573-1/ - https://www.debian.org/security/2018/dsa-4115 - http://www.security
iner: References: - https://usn.ubuntu.com/3573-1/ - https://www.debian.org/security/2018/dsa-4115 - http://www.securityfocus.com/bid/103105 - http://savannah.nongnu.org/forum/forum.php?forum_id=9095 - https://security.gentoo.org/glsa/201804-17 - https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1114.txt - https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html - http://www.kb.cert.org/vuls/id/940439 - https://access.redhat.com/errata/RHSA-2018:0377 - https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf
CVE ID: CVE-2018-5380 State: PUBLISHED Published: 2018-02-19T13:00:00Z Last Updated: 2024-09-17T01:05:46.243Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Quagga Products: bgpd Problem Types: CWE-125 Description: The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3573-1/ - https://www.debian.org/security/2018/dsa-4115 - http://savannah.nongnu.org/forum/forum.php?forum_id=9095 - https://security.gentoo.org/glsa/201804-17 - https://lists.debian.org/debian-lts-ann
org/forum/forum.php?forum_id=9095 - https://security.gentoo.org/glsa/201804-17 - https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html - https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1550.txt - http://www.kb.cert.org/vuls/id/940439 - https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf
CVE ID: CVE-2018-5381 State: PUBLISHED Published: 2018-02-19T13:00:00Z Last Updated: 2024-09-16T16:17:27.709Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Quagga Products: bgpd Problem Types: CWE-228 Description: The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://gogs.quagga.net/Quagga/quagga/src/master/doc/s
Additional Analyst Notes: - CVE Program Container: References: - https://gogs.quagga.net/Quagga/quagga/src/master/doc/security/Quagga-2018-1975.txt - https://usn.ubuntu.com/3573-1/ - https://www.debian.org/security/2018/dsa-4115 - http://savannah.nongnu.org/forum/forum.php?forum_id=9095 - https://security.gentoo.org/glsa/201804-17 - https://lists.debian.org/debian-lts-announce/2018/02/msg00021.html - http://www.kb.cert.org/vuls/id/940439 - https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf
CVE ID: CVE-2018-5382 State: PUBLISHED Published: 2018-04-16T13:00:00Z Last Updated: 2024-09-16T16:27:56.228Z Vendors: Legion of the Bouncy Castle Products: Bouncy Castle Problem Types: CWE-327 Description: The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the
ecific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103453 - https://access.redhat.com/errata/RHSA-2018:2927 - https://www.kb.cert.org/vuls/id/306792 - https://www.bouncycastle.org/releasenotes.html - https://www.oracle.com/security-alerts/cpuoct2020.html
CVE ID: CVE-2018-5383 State: PUBLISHED Published: 2018-08-07T21:00:00Z Last Updated: 2024-09-16T20:36:44.114Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Apple, Android Open Source Project Products: macOS, iOS, Android Problem Types: CWE-325 Description: Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device. Additional Analyst Notes:
exchange, which may allow a remote attacker to obtain the encryption key used by the device. Additional Analyst Notes: - CVE Program Container: References: - http://www.cs.technion.ac.il/~biham/BT/ - http://www.securitytracker.com/id/1041432 - https://www.kb.cert.org/vuls/id/304725 - https://www.bluetooth.com/news/unknown/2018/07/bluetooth-sig-security-update - http://www.securityfocus.com/bid/104879 - https://lists.debian.org/debian-lts-announce/2019/04/msg00005.html - https://access.redhat.com/errata/RHSA-2019:2169 - https://usn.ubuntu.com/4094-1/ - https://usn.ubuntu.com/4095-2/ - https://usn.ubuntu.com/4095-1/ - https://usn.ubuntu.com/4118-1/ - https://usn.ubuntu.com/4351-1/
CVE ID: CVE-2018-5384 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T05:33:44.385Z Vendors: Navarino Products: Infinity Problem Types: CWE-89 Description: Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user can get info from the underlying postgresql database that could lead into to total compromise of the product. The said script is available with no authentication. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html - https://medium.com/%40evsty
stormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html - https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 - http://www.securityfocus.com/bid/103544 - https://www.kb.cert.org/vuls/id/184077
CVE ID: CVE-2018-5385 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T05:33:44.207Z Vendors: Navarino Products: Infinity Problem Types: CWE-384 Description: Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authentication in some installations. This could lead to phishing attacks that can bypass the two factor authentication that is present in some installations. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html - https://medium.com/%40evstykas/pwni
urity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html - https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 - http://www.securityfocus.com/bid/103544 - https://www.kb.cert.org/vuls/id/184077
CVE ID: CVE-2018-5386 State: PUBLISHED Published: 2018-07-24T15:00:00 Last Updated: 2024-08-05T05:33:44.404Z Vendors: Navarino Products: Infinity Problem Types: CWE-288 Description: Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.html - https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3 - http://www.securityfocus.com/bid/103544 - https://www.kb.cert.org/vuls/id/184077
CVE ID: CVE-2018-5387 State: PUBLISHED Published: 2018-07-24T15:00:00Z Last Updated: 2024-09-16T22:55:40.613Z Vendors: Wizkunde Products: SAMLBase Problem Types: CWE-287 Description: Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers. Additional Analyst Notes: - CVE Program Container: References: - https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations - https://www.kb.cert.org/vuls/id/475445 - https://github.c
inds-saml-vulnerabilities-affecting-multiple-implementations - https://www.kb.cert.org/vuls/id/475445 - https://github.com/GoGentoOSS/SAMLBase/issues/3 - https://github.com/GoGentoOSS/SAMLBase/commit/482cdf8c090e0f1179073034ebcb609ac7c3f5b3
CVE ID: CVE-2018-5388 State: PUBLISHED Published: 2018-05-31T00:00:00 Last Updated: 2024-08-05T05:33:44.315Z Vendors: strongSwan Products: strongSwan Problem Types: CWE-124 Description: In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaustion and denial of service while reading from the socket. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/338343 - https://security.gentoo.org/glsa/201811-16 - https://git.strongswan.org/?p=strongswan.git%3Ba=commitdiff%3Bh=0acd1ab4 - http://www.securityfocus.com/bid/104263 - https://usn.ubuntu.com/3771-1/ - https://www.de
%3Ba=commitdiff%3Bh=0acd1ab4 - http://www.securityfocus.com/bid/104263 - https://usn.ubuntu.com/3771-1/ - https://www.debian.org/security/2018/dsa-4229 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html - http://packetstormsecurity.com/files/172833/strongSwan-VPN-Charon-Server-Buffer-Overflow.html
CVE ID: CVE-2018-5389 State: PUBLISHED Published: 2018-09-06T21:00:00 Last Updated: 2024-08-05T05:33:44.296Z Vendors: strongSwan Products: Strongswan Problem Types: CWE-521 Weak Password Requirements, CWE-323 Reusing a Nonce, Key Pair in Encryption Description: The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IKE could lead to cross-protocol authentication bypasses. It is well known, that the aggressive mode of IKEv1 PSK is vulnerable to offline dictionary or brute force attacks. For the main mode, however, only an online attack against PSK authentication was thought to be feasible. Th
rce attacks. For the main mode, however, only an online attack against PSK authentication was thought to be feasible. This vulnerability could allow an attacker to recover a weak Pre-Shared Key or enable the impersonation of a victim host or network. Additional Analyst Notes: - CVE Program Container: References: - https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-felsch.pdf - https://www.kb.cert.org/vuls/id/857035 - https://web-in-security.blogspot.com/2018/08/practical-dictionary-attack-on-ipsec-ike.html - https://blogs.cisco.com/security/great-cipher-but-where-did-you-get-that-key - https://my.f5.com/manage/s/article/K42378447
CVE ID: CVE-2018-5390 State: PUBLISHED Published: 2018-08-06T20:00:00 Last Updated: 2024-08-05T05:33:44.409Z Vendors: Linux Products: Linux Kernel Problem Types: CWE-400 Description: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2785 - https://www.kb.cert.org/vuls/id/962459 - https://usn.ubuntu.com/3741-2/ - https://access.redhat.com/errata/RHSA-2018:2776 - https://access.redhat.com/errata/RHSA-2018:2933 - https://access.redhat.com/errata/RHSA-2
at.com/errata/RHSA-2018:2776 - https://access.redhat.com/errata/RHSA-2018:2933 - https://access.redhat.com/errata/RHSA-2018:2403 - https://access.redhat.com/errata/RHSA-2018:2395 - https://usn.ubuntu.com/3763-1/ - https://access.redhat.com/errata/RHSA-2018:2384 - https://usn.ubuntu.com/3741-1/ - https://access.redhat.com/errata/RHSA-2018:2402 - https://access.redhat.com/errata/RHSA-2018:2948 - https://usn.ubuntu.com/3742-2/ - http://www.securitytracker.com/id/1041434 - https://usn.ubuntu.com/3732-2/ - http://www.securityfocus.com/bid/104976 - https://lists.debian.org/debian-lts-announce/2018/08/msg00014.html - http://www.securitytracker.com/id/1041424 - https://usn.ubuntu.com/3742-1/ - https
-lts-announce/2018/08/msg00014.html - http://www.securitytracker.com/id/1041424 - https://usn.ubuntu.com/3742-1/ - https://access.redhat.com/errata/RHSA-2018:2924 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180824-linux-tcp - https://access.redhat.com/errata/RHSA-2018:2789 - https://www.debian.org/security/2018/dsa-4266 - https://access.redhat.com/errata/RHSA-2018:2645 - https://usn.ubuntu.com/3732-1/ - https://access.redhat.com/errata/RHSA-2018:2791 - https://access.redhat.com/errata/RHSA-2018:2790 - http://www.openwall.com/lists/oss-security/2019/06/28/2 - http://www.openwall.com/lists/oss-security/2019/07/06/3 - http://www.openwall.com/lists/oss-secu
security/2019/06/28/2 - http://www.openwall.com/lists/oss-security/2019/07/06/3 - http://www.openwall.com/lists/oss-security/2019/07/06/4 - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 - https://security.netapp.com/advisory/ntap-20180815-0003/ - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt - https://www.synology.com/support/security/Synology_SA_18_41 - https://support.f5.com/csp/article/K95343321 - https://www.a10networks.com/support/security-advisories/tcp-ip-cve-2018-539
tps://support.f5.com/csp/article/K95343321 - https://www.a10networks.com/support/security-advisories/tcp-ip-cve-2018-5390-segmentsmack - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=1a4f14bab1868b443f0dd3c55b689a478f82e72e - https://support.f5.com/csp/article/K95343321?utm_source=f5support&amp%3Butm_medium=RSS - https://cert-portal.siemens.com/productcert/pdf/ssa-377115.pdf - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181031-02-linux-en
CVE ID: CVE-2018-5391 State: PUBLISHED Published: 2018-09-06T21:00:00 Last Updated: 2024-08-05T05:33:44.368Z Vendors: Linux Products: Kernel Problem Types: CWE-400 Description: The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size. Additional Analyst Notes: - CVE Program
in the Linux kernel with the increase of the IP fragment reassembly queue size. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3540 - https://access.redhat.com/errata/RHSA-2018:2785 - https://access.redhat.com/errata/RHSA-2018:3083 - https://access.redhat.com/errata/RHSA-2018:2925 - https://www.kb.cert.org/vuls/id/641765 - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-004.txt - https://usn.ubuntu.com/3741-2/ - http://www.securitytracker.com/id/1041476 - https://access.redhat.com/errata/RHSA-2018:3459 - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19f
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=c30f1fc041b74ecdb072dd44f858750414b8b19f - https://access.redhat.com/errata/RHSA-2018:2933 - https://usn.ubuntu.com/3740-2/ - https://usn.ubuntu.com/3741-1/ - https://access.redhat.com/errata/RHSA-2018:3590 - https://access.redhat.com/errata/RHSA-2018:2948 - https://usn.ubuntu.com/3742-2/ - https://usn.ubuntu.com/3740-1/ - http://www.securityfocus.com/bid/105108 - https://lists.debian.org/debian-lts-announce/2018/08/msg00014.html - https://usn.ubuntu.com/3742-1/ - https://access.redhat.com/errata/RHSA-2018:2924 - https://www.debian.org/security/2018/dsa-4272 - https://access.redhat.com/errata/RHSA-2018:3586 - http
/RHSA-2018:2924 - https://www.debian.org/security/2018/dsa-4272 - https://access.redhat.com/errata/RHSA-2018:3586 - https://access.redhat.com/errata/RHSA-2018:2846 - http://www.securitytracker.com/id/1041637 - https://access.redhat.com/errata/RHSA-2018:3096 - https://access.redhat.com/errata/RHSA-2018:2791 - https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html - https://security.netapp.com/advisory/ntap-20181003-0002/ - http://www.openwall.com/lists/oss-security/2019/06/28/2 - http://www.openwall.com/lists/oss-security/2019/07/06/3 - http://www.openwall.com/lists/oss-security/2019/07/06/4 - https://support.f5.com/csp/article/K74374841?utm_source=f5support&amp%3Butm_medium=RSS -