PulseLinuxLINUX UPDATE INTELLIGENCE

CVE 2018 document archive · 32

Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →

1,627 documents · Identifier year 2018 · 32 / 33

  1. CVE-2018-1271spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
  2. CVE-2018-1270spring-framework: Possible RCE via spring messaging
  3. CVE-2018-1258spring-security-core: Unauthorized Access with Spring Security Method Security
  4. CVE-2018-1199spring-framework: Improper URL path validation allows for bypassing of security checks on static resources
  5. CVE-2018-1172squid: Incorrect pointer handling when processing ESI responses allows denial of service
  6. CVE-2018-1152libjpeg-turbo: Divide by zero allows for denial of service via crafted BMP image
  7. CVE-2018-1140libldb: LDAP server crash via distinguishedName
  8. CVE-2018-1139samba: Weak authentication protocol regression
  9. CVE-2018-1130kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash
  10. CVE-2018-1129ceph: cephx uses weak signatures
  11. CVE-2018-1128ceph: cephx protocol is vulnerable to replay attack
  12. CVE-2018-1126procps: incorrect integer size in proc/alloc.* leading to truncation / integer overflow issues
  13. CVE-2018-1125procps: stack buffer overflow in pgrep
  14. CVE-2018-1124procps: Integer overflows leading to heap overflow in file2strvec
  15. CVE-2018-1123procps: denial of service in ps via mmap buffer overflow
  16. CVE-2018-1122procps: Local privilege escalation in top
  17. CVE-2018-1121procps: process hiding through race condition enumerating /proc
  18. CVE-2018-1120kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service
  19. CVE-2018-1118kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg()
  20. CVE-2018-1116polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in polkitd
  21. CVE-2018-1115postgresql: Too-permissive access control list on function pg_logfile_rotate()
  22. CVE-2018-1114undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service
  23. CVE-2018-1113setup: nologin listed in /etc/shells violates security expectations
  24. CVE-2018-1112glusterfs: auth.allow allows unauthenticated clients to mount gluster volumes (CVE-2018-1088 regression)
  25. CVE-2018-1111dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script
  26. CVE-2018-1108kernel: drivers: getrandom(2) unblocks too early after system boot
  27. CVE-2018-1107nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format
  28. CVE-2018-1106PackageKit: authentication bypass allows to install signed packages without administrator privileges
  29. CVE-2018-1100zsh: buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution
  30. CVE-2018-1099etcd: DNS rebinding vulnerability in etcd server
  31. CVE-2018-1098etcd: Cross-site request forgery via crafted local POST forms
  32. CVE-2018-1095kernel: out-of-bound access in fs/posix_acl.c:get_acl() causes crash with crafted ext4 image
  33. CVE-2018-1094kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image
  34. CVE-2018-1093kernel: Out of bounds read in ext4/balloc.c:ext4_valid_block_bitmap() causes crash with crafted ext4 image
  35. CVE-2018-1092kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4 image
  36. CVE-2018-1091kernel: guest kernel crash during core dump on POWER9 host
  37. CVE-2018-1089389-ds-base: ns-slapd crash via large filter value in ldapsearch
  38. CVE-2018-1088glusterfs: Privilege escalation via gluster_shared_storage when snapshot scheduling is enabled
  39. CVE-2018-1087Kernel: KVM: error in exception handling leads to wrong debug stack value
  40. CVE-2018-1086pcs: Debug parameter removal bypass, allowing information disclosure
  41. CVE-2018-1084corosync: Integer overflow in exec/totemcrypto.c:authenticate_nss_2_3() function
  42. CVE-2018-1083zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c
  43. CVE-2018-1080pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access
  44. CVE-2018-1079pcs: Privilege escalation via authorized user malicious REST call
  45. CVE-2018-1074ovirt-engine: API exposes power management credentials to administrators
  46. CVE-2018-1073ovirt-engine: account enumeration through login to web console
  47. CVE-2018-1071zsh: Stack-based buffer overflow in exec.c:hashcmd()
  48. CVE-2018-1068kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c
  49. CVE-2018-1067undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)
  50. CVE-2018-1066kernel: Null pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() when empty TargetInfo is returned in NTLMSSP setup negotiation response allowing to crash client's kernel
CVE 2018 document archive — Page 32 | PulseLinux