CVE-2018-10545

php: Dumpable FPM child processes allow bypassing opcache access controls

An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Netapp and 2 more

Products

Ubuntu Linux Debian Linux Storage Automation Store and 2 more

CVE-2018-10529

LibRaw: Out-of-bounds read in X3F property table list functionality in libraw_x3f.cpp and libraw_cxx.cpp

An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds read affecting the X3F property table list implementation in libraw_x3f.cpp and libraw_cxx.cpp.

CVSS 3.0 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Canonical Libraw

Products

Ubuntu Linux Libraw

CVE-2018-10528

LibRaw: Stack-based buffer overflow in libraw_cxx.cpp:utf2char() allows for potential code execution

An issue was discovered in LibRaw 0.18.9. There is a stack-based buffer overflow in the utf2char function in libraw_cxx.cpp.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Canonical Libraw

Products

Ubuntu Linux Libraw

CVE-2018-10360

file: out-of-bounds read via a crafted ELF file

The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

CVSS 3.0 · 6.5 Medium EPSS 3.4% KEV · Not listed

Vendors

Canonical File Project Opensuse and 1 more

Products

Ubuntu Linux File Leap and 6 more

CVE-2018-10323

kernel: Invalid pointer dereference in xfs_bmapi_write() when mounting and operating on crafted xfs image allows denial of service

The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted xfs image.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux

Products

Ubuntu Linux Debian Linux Linux Kernel

CVE-2018-10196

graphviz: NULL pointer dereference in rebuild_vlis

NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows remote attackers to cause a denial of service (application crash) via a crafted file.

CVSS 3.0 · 5.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Canonical Fedoraproject Graphviz

Products

Ubuntu Linux Fedora Graphviz

CVE-2018-10194

ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c

The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Artifex Canonical Debian and 1 more

Products

Ghostscript Ubuntu Linux Debian Linux and 7 more

CVE-2018-10177

ImageMagick: Infinite loop in coders/png.c:ReadOneMNGImage() allows attackers to cause a denial of service via crafted MNG file

In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file.

CVSS 3.0 · 6.5 Medium EPSS 3.1% KEV · Not listed

Vendors

Canonical Imagemagick Redhat

Products

Ubuntu Linux Imagemagick Enterprise Linux

CVE-2018-10124

kernel: Undefined behaviour with INT_MIN argument in kernel/signal.c:kill_something_info() allows for denial of service

The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN argument.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux

Products

Ubuntu Linux Debian Linux Linux Kernel

CVE-2018-10120

libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of service with crafted document

The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Libreoffice and 1 more

Products

Ubuntu Linux Debian Linux Libreoffice and 4 more

CVE-2018-10119

libreoffice: Use-after-free in sdstor/stgstrms.cxx:StgSmallStrm class allows for denial of service with crafted document

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed

Vendors

Canonical Debian Libreoffice and 1 more

Products

Ubuntu Linux Debian Linux Libreoffice and 4 more

CVE-2018-10087

kernel: Undefined behavior in kernel/exit.c:kernel_wait4() function allows local denial of service

The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified architecture and compiler is used, might allow local users to cause a denial of service by triggering an attempted use of the -INT_MIN value.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux

Products

Ubuntu Linux Debian Linux Linux Kernel

CVE-2018-1000888

php-pear: Unsafe deserialization of data in Archive_Tar class

PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar object injection, arbitrary file deletion can occur because `@unlink($this->_temp_tarname)` is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.

CVSS 3.0 · 8.8 High EPSS 19.1% KEV · Not listed

Vendors

Canonical Debian Php

Products

Ubuntu Linux Debian Linux Pear Archive Tar

CVE-2018-1000878

libarchive: Use after free in RAR decoder resulting in a denial of service

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

CVSS 3.1 · 8.8 High EPSS 4.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 6 more

CVE-2018-1000877

libarchive: Double free in RAR decoder resulting in a denial of service

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

CVSS 3.1 · 8.8 High EPSS 4.6% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 5 more

CVE-2018-1000876

binutils: integer overflow leads to heap-based buffer overflow in objdump

binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Gnu Redhat

Products

Ubuntu Linux Binutils Ansible Tower and 4 more

CVE-2018-1000858

gnupg2: Cross site request forgery in dirmngr resulting in an information disclosure or denial of service

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.

CVSS 3.0 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Canonical Gnupg Redhat

Products

Ubuntu Linux Gnupg Enterprise Linux

CVE-2018-1000852

freerdp: out of bounds read in drdynvc_process_capability_request

FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c, drdynvc_process_capability_request that can result in The RDP server can read the client's memory.. This attack appear to be exploitable via RDPClient must connect the rdp server with echo option. This vulnerability appears to have been fixed in after commit 205c612820dac644d665b5bb1cdf437dc5ca01e3.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed

Vendors

Canonical Fedoraproject Freerdp and 1 more

Products

Ubuntu Linux Fedora Freerdp and 1 more

CVE-2018-1000808

pyOpenSSL: Failure to release memory before removing last reference in PKCS #12 Store

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.

CVSS 3.0 · 5.9 Medium EPSS 1.9% KEV · Not listed

Vendors

Canonical Pyopenssl Project Redhat

Products

Ubuntu Linux Pyopenssl Enterprise Linux Desktop and 4 more

CVE-2018-1000807

pyOpenSSL: Use-after-free in X509 object handling

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed

Vendors

Canonical Pyopenssl Redhat

Products

Ubuntu Linux Pyopenssl Enterprise Linux Desktop and 3 more