PulseLinuxLINUX UPDATE INTELLIGENCE

CVE 2018 document archive · 19

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

1,627 documents · Identifier year 2018 · 19 / 33

  1. CVE-2018-10916lftp: particular remote file names may lead to current working directory erased
  2. CVE-2018-10915postgresql: Certain host connection parameters defeat client-side security defenses
  3. CVE-2018-10914glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c
  4. CVE-2018-10913glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c
  5. CVE-2018-10911glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory
  6. CVE-2018-10910bluez: failure in disabling Bluetooth discoverability in certain cases may lead to the unauthorized pairing of Bluetooth devices
  7. CVE-2018-10908vdsm: calls to qemu-img are not protected by prlimit/ulimit
  8. CVE-2018-10907glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code
  9. CVE-2018-10906fuse: bypass of the "user_allow_other" restriction when SELinux is active
  10. CVE-2018-10904glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code
  11. CVE-2018-10903python-cryptography: GCM tag forgery via truncated tag in finalize_with_tag API
  12. CVE-2018-10902kernel: MIDI driver race condition leads to a double-free
  13. CVE-2018-10901kernel: kvm: vmx: host GDT limit corruption
  14. CVE-2018-10897yum-utils: reposync: improper path validation may lead to directory traversal
  15. CVE-2018-10896cloud-init: default configuration disabled deletion of SSH host keys
  16. CVE-2018-10893spice-client: Insufficient encoding checks for LZ can cause different integer/buffer overflows
  17. CVE-2018-10892docker: container breakout without selinux in enforcing mode
  18. CVE-2018-10883kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function
  19. CVE-2018-10882kernel: stack-out-of-bounds write infs/jbd2/transaction.c
  20. CVE-2018-10881kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image
  21. CVE-2018-10880kernel: stack-out-of-bounds write in ext4_update_inline_data function
  22. CVE-2018-10879kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file
  23. CVE-2018-10878kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image
  24. CVE-2018-10877kernel: out-of-bound access in ext4_ext_drop_refs function with a crafted ext4 image
  25. CVE-2018-10876kernel: use-after-free in jbd2_journal_commit_transaction funtion
  26. CVE-2018-10875ansible: ansible.cfg is being read from current working directory allowing possible code execution
  27. CVE-2018-10874ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution
  28. CVE-2018-10873spice: Missing check in demarshal.py:write_validate_array_item() allows for buffer overflow and denial of service
  29. CVE-2018-10872kernel: error in exception handling leads to DoS (CVE-2018-8897 regression)
  30. CVE-2018-10871389-ds-base: replication and the Retro Changelog plugin store plaintext password by default
  31. CVE-2018-10862wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)
  32. CVE-2018-10861ceph: ceph-mon does not perform authorization on OSD pool ops
  33. CVE-2018-10860perl-Archive-Zip: Directory traversal in Archive::Zip
  34. CVE-2018-10858samba: Insufficient input validation in libsmbclient
  35. CVE-2018-10856podman: Containers run as non-root users do not drop capabilities
  36. CVE-2018-10855ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs
  37. CVE-2018-10853kernel: kvm: guest userspace to guest kernel write
  38. CVE-2018-10852sssd: information leak from the sssd-sudo responder
  39. CVE-2018-10850389-ds-base: race condition on reference counter leads to DoS using persistent search
  40. CVE-2018-10846gnutls: "Just in Time" PRIME + PROBE cache-based side channel attack can lead to plaintext recovery
  41. CVE-2018-10845gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant
  42. CVE-2018-10844gnutls: HMAC-SHA-256 vulnerable to Lucky thirteen attack due to not enough dummy function calls
  43. CVE-2018-10841glusterfs: access trusted peer group via remote-host command
  44. CVE-2018-10840kernel: Heap-based buffer overflow in fs/ext4/xattr.c:ext4_xattr_set_entry() with crafted ext4 image
  45. CVE-2018-10839QEMU: ne2000: integer overflow leads to buffer overflow issue
  46. CVE-2018-10811strongswan: Missing initialization of a variable in IKEv2 key derivation allows denial of service
  47. CVE-2018-10805ImageMagick: Memory leak in ReadYCBCRImage
  48. CVE-2018-10804ImageMagick: Memory leak in WriteTIFFImage
  49. CVE-2018-10801libtiff: memory leak in bmp2tiff tool
  50. CVE-2018-10780exiv2: heap-based buffer over-read in Exiv2::Image::byteSwap2 function in image.cpp
CVE 2018 document archive — Page 19 | PulseLinux