huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-11469: haproxy: Information disclosure in check_request_for_cacheability function in proto_http.c
Component: haproxy
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2018-05-25T00:00:00+00:00

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.

Statement: Red Hat Product Security has rated this issue as having a security impact of Moderate, and a future update may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v1.8.10
Upstream repository: https://git.haproxy.org/haproxy-1.8.git
Upstream fix commit: 17514045e5d934dede62116216c1b016fe23dd06
CVE-2018-11506: kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-05-21T00:00:00+00:00

The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel allows local users to cause a denial of service via a stack-based buffer overflow or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer.


Affected upstream versions: n/a
Fixed upstream versions: v4.17
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f7068114d45ec55996b9040e98111afa56e010fe
CVE-2018-11627: rubygem-sinatra: XSS in the 400 Bad Request page
Component: rubygem-sinatra
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2018-05-22T00:00:00+00:00

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.


Affected upstream versions: n/a
Fixed upstream versions: v2.0.2
Upstream repository: https://github.com/sinatra/sinatra
Upstream fix commit: 12786867d6faaceaec62c7c2cb5b0e2dc074d71a
CVE-2018-11645: ghostscript: status command permitted with -dSAFER in psi/zfile.c allowing attackers to identify the size and existence of files
Component: ghostscript
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2016-10-05T00:00:00+00:00

Ghostscript did not honor the -dSAFER option when executing the "status" instruction, which can be used to retrieve information such as a file's existence and size. A specially crafted postscript document could use this flow to gain information on the targeted system's filesystem content.


Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: b60d50b7567369ad856cebe1efb6cd7dd2284219
CVE-2018-12022: jackson-databind: improper polymorphic deserialization of types from Jodd-db library
Component: jackson-databind
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-05-29T00:00:00+00:00

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances.

Statement: Red Hat Satellite 6 is not affected by this issue, since Candlepin's java runtime environment does not load Jodd classes.

Red Hat Virtualization 4 is not affected by this issue, since it does not load Jodd classes.

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.7.9.4
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 28badf7ef60ac3e7ef151cd8e8ec010b8479226a
CVE-2018-12023: jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver
Component: jackson-databind
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-06-08T00:00:00+00:00

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Oracle JDBC classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances.

Statement: Red Hat Satellite 6 is not affected by this issue, since Candlepin's java runtime environment does not load Oracle's JDBC classes.

Red Hat Virtualization 4 is not affected by this issue, since it does not load Oracle's JDBC classes.

Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.7.9.4
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 28badf7ef60ac3e7ef151cd8e8ec010b8479226a
CVE-2018-12232: kernel: NULL pointer dereference if close and fchownat system calls share a socket file descriptor
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-06-04T00:00:00+00:00

A NULL pointer dereference issue was found in the Linux kernel. If the close() and fchownat() system calls share a socket file descriptor as an argument, then the two calls can race and trigger a NULL pointer dereference leading to a system crash and a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6d8c50dcb029872b298eea68cc6209c866fd3e14
CVE-2018-12326: redis: Code execution in redis-cli via crafted command line arguments
Component: redis
Severity: Low
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-06-13T00:00:00+00:00

The Redis command line tool 'redis-cli' is vulnerable to a buffer overflow through the -h (host) command line parameter. The redis-cli may be used by other services; if these services do not adequately filter the host input it could lead to code execution with the privilege level of that service.


Affected upstream versions: n/a
Upstream repository: https://github.com/antirez/redis
Upstream fix commit: 9fdcc15962f9ff4baebe6fdd947816f43f730d50
CVE-2018-12537: vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers
Component: vertx
Severity: Moderate
CWE: CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'))
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2018-06-13T00:00:00+00:00

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.

Statement: While the affected artifact is being shipped in Fuse 6.3 via camel-vertx component, the vulnerable code is not being used, therefore Fuse 6.3 is not affected.

Affected upstream versions: 3.0 < unspecified, unspecified <= 3.5.1
Fixed upstream versions: unspecified
Upstream repository: https://github.com/eclipse/vert.x
Upstream fix commit: 1bb6445226c39a95e7d07ce3caaf56828e8aab72
CVE-2018-12910: libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames
Component: libsoup
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-07-03T00:00:00+00:00

An out-of-bounds read has been discovered in libsoup when getting cookies from a URI with empty hostname. An attacker may use this flaw to cause a crash in the application.


Affected upstream versions: n/a
Upstream repository: https://gitlab.gnome.org/GNOME/gnome-sdk-images
Upstream fix commit: 4215b8a21b3b3055e947312a8920df94f93ba047
CVE-2018-13053: kernel: Integer overflow in the alarm_timer_nsleep function
Component: kernel
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-06-27T00:00:00+00:00

A flaw was found in the alarm_timer_nsleep() function in kernel/time/alarmtimer.c in the Linux kernel. The ktime_add_safe() function is not used and an integer overflow can happen causing an alarm not to fire or possibly a denial-of-service if using a large relative timeout.


Affected upstream versions: n/a
Fixed upstream versions: v4.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
Upstream fix commit: 5f936e19cc0ef97dbe3a56e9498922ad5ba1edef
CVE-2018-13093: kernel: NULL pointer dereference in lookup_slow function
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2018-04-12T00:00:00+00:00

An issue was discovered in the XFS filesystem in fs/xfs/xfs_icache.c in the Linux kernel. There is a NULL pointer dereference leading to a system panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during an allocation.


Affected upstream versions: n/a
Fixed upstream versions: copy-file-range-fixes-1
Upstream repository: https://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git
Upstream fix commit: afca6c5b2595fc44383919fba740c194b0b76aff
CVE-2018-13094: kernel: NULL pointer dereference in xfs_da_shrink_inode function
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2018-06-07T00:00:00+00:00

An issue was discovered in the XFS filesystem in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel. A NULL pointer dereference may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. This can lead to a system crash and a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: copy-file-range-fixes-1
Upstream repository: https://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git
Upstream fix commit: bb3d48dcf86a97dc25fe9fc2c11938e19cb4399a
CVE-2018-13095: kernel: NULL pointer dereference in fs/xfs/libxfs/xfs_inode_buf.c
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2018-06-03T00:00:00+00:00

An issue was discovered in the XFS filesystem in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel. A denial of service due to the NULL pointer dereference can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 23fcb3340d033d9f081e21e6c12c2db7eaa541d3
CVE-2018-13346: mercurial: Missing check for fragment start position in mpatch.c:mpatch_apply()
Component: mercurial
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-06-06T00:00:00+00:00

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.


Affected upstream versions: n/a
Upstream repository: https://www.mercurial-scm.org/repo/hg
Upstream fix commit: faa924469635
CVE-2018-13347: mercurial: Buffer underflow in mpatch.c:mpatch_apply()
Component: mercurial
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-06-06T00:00:00+00:00

mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.


Affected upstream versions: n/a
Upstream repository: https://www.mercurial-scm.org/repo/hg
Upstream fix commit: 1acfc35d478c
CVE-2018-13405: kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members
Component: kernel
Severity: Important
CWE: CWE-284 (Improper Access Control)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2018-07-05T00:00:00+00:00

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not.


Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7
CVE-2018-13785: libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service
Component: libpng
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2018-04-05T00:00:00+00:00

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v1.6.35
Upstream repository: https://github.com/glennrp/libpng
Upstream fix commit: 8a05766cb74af05c04c53e6c9d60c13fc4d59bf2
CVE-2018-13988: poppler: out of bounds read in pdfunite
Component: poppler
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-07-23T00:00:00+00:00

Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file.

Statement: Red Hat Product Security has rated this issue as having a security impact of Low, and a future update may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: poppler-0.67.0
Upstream repository: https://cgit.freedesktop.org/poppler/poppler
Upstream fix commit: 004e3c10df0abda214f0c293f9e269fdd979c5ee
CVE-2018-14036: accountsservice: insufficient path check in user_change_icon_file_authorized_cb() in user.c
Component: accountsservice
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Public date: 2018-07-13T00:00:00+00:00

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/accountsservice
Upstream fix commit: f9abd359f71a5bce421b9ae23432f539a067847a
CVE-2018-14340: wireshark: Multiple dissectors could crash (wnpa-sec-2018-36)
Component: wireshark
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-07-18T00:00:00+00:00

In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, dissectors that support zlib decompression could crash. This was addressed in epan/tvbuff_zlib.c by rejecting negative lengths to avoid a buffer over-read.


Affected upstream versions: n/a
Fixed upstream versions: v2.2.16
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 672d882a53f96730e4ef1e5b1639c585823b0df8
CVE-2018-14341: wireshark: DICOM dissector infinite loop (wnpa-sec-2018-39)
Component: wireshark
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-07-18T00:00:00+00:00

In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the DICOM dissector could go into a large or infinite loop. This was addressed in epan/dissectors/packet-dcm.c by preventing an offset overflow.


Affected upstream versions: n/a
Fixed upstream versions: v2.2.16
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 2e716c32be6aa20e1813b0002878853e71f8b2f4
CVE-2018-14354: mutt: Remote code injection vulnerability to an IMAP mailbox
Component: mutt
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 9.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2018-07-16T00:00:00+00:00

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.


Affected upstream versions: n/a
Fixed upstream versions: mutt-1-10-1-rel
Upstream repository: https://gitlab.com/muttmua/mutt
Upstream fix commit: 185152818541f5cdc059cbff3f3e8b654fc27c1d
CVE-2018-14355: mutt: IMAP header caching path traversal vulnerability
Component: mutt
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2018-07-16T00:00:00+00:00

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name.


Affected upstream versions: n/a
Fixed upstream versions: mutt-1-10-1-rel
Upstream repository: https://gitlab.com/muttmua/mutt
Upstream fix commit: 31eef6c766f47df8281942d19f76e35f475c781d
CVE-2018-14357: mutt: Remote Code Execution via backquote characters
Component: mutt
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L)
Public date: 2018-07-08T00:00:00+00:00

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with an automatic subscription.


Affected upstream versions: n/a
Fixed upstream versions: mutt-1-10-1-rel
Upstream repository: https://gitlab.com/muttmua/mutt
Upstream fix commit: 185152818541f5cdc059cbff3f3e8b654fc27c1d
CVE-2018-14362: mutt: POP body caching path traversal vulnerability
Component: mutt
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2018-07-16T00:00:00+00:00

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. pop.c does not forbid characters that may have unsafe interaction with message-cache pathnames, as demonstrated by a '/' character.


Affected upstream versions: n/a
Fixed upstream versions: mutt-1-10-1-rel
Upstream repository: https://gitlab.com/muttmua/mutt
Upstream fix commit: 6aed28b40a0410ec47d40c8c7296d8d10bae7576
CVE-2018-14368: wireshark: Bazaar dissector infinite loop (wnpa-sec-2018-40)
Component: wireshark
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-07-18T00:00:00+00:00

In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the Bazaar protocol dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-bzr.c by properly handling items that are too long.


Affected upstream versions: n/a
Fixed upstream versions: v2.2.16
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 6c44312f465014eb409d766a9828b7f101f6251c
CVE-2018-14371: mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter
Component: mojarra
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2018-07-18T00:00:00+00:00

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.


Affected upstream versions: n/a
Fixed upstream versions: 2.3.3.102
Upstream repository: https://github.com/eclipse-ee4j/mojarra
Upstream fix commit: 1b434748d9239f42eae8aa7d37d7a0930c061e24
CVE-2018-14461: tcpdump: Buffer over-read in ldp_tlv_print() function in print-ldp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing LDP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: aa5c6b710dfd8020d2c908d6b3bd41f1da719b3b
CVE-2018-14462: tcpdump: Buffer over-read in icmp_print() function in print-icmp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read flaw was discovered in tcpdump while printing ICMP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application. System availability is the highest threat from this vulnerability


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3
CVE-2018-14463: tcpdump: Buffer over-read in vrrp_print() function in print-vrrp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing VRRP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 3de07c772166b7e8e8bb4b9d1d078f1d901b570b
CVE-2018-14464: tcpdump: Buffer over-read in lmp_print_data_link_subobjs() function in print-lmp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing LMP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: d97e94223720684c6aa740ff219e0d19426c2220