Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

10 vulnerabilities found for procps-ng by procps-ng_project

CVE-2018-1125 (GCVE-0-2018-1125)

Vulnerability from nvd – Published: 2018-05-23 14:00 – Updated: 2025-12-17 22:09
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.
Severity ?
4.4 (Medium)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE
Assigner
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3658-3/ vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng, procps Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.542Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125"
          },
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "USN-3658-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-3/"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2018-1125",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T22:09:07.048887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-121",
                "description": "CWE-121 Stack-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T22:09:11.636Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng, procps",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-26T23:06:07.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125"
        },
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "USN-3658-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-3/"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1125",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng, procps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "4.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-121"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125"
            },
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "USN-3658-3",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-3/"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1125",
    "datePublished": "2018-05-23T14:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2025-12-17T22:09:11.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-1123 (GCVE-0-2018-1123)

Vulnerability from nvd – Published: 2018-05-23 14:00 – Updated: 2025-12-17 21:19
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).
Severity ?
3.9 (Low)
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CWE
Assigner
References
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/201805-14 vendor-advisoryx_refsource_GENTOO
https://www.exploit-db.com/exploits/44806/ exploitx_refsource_EXPLOIT-DB
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3658-3/ vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
https://lists.apache.org/thread.html/rf4c02775860… mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r58af02e294b… mailing-listx_refsource_MLIST
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng, procps Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.635Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "GLSA-201805-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201805-14"
          },
          {
            "name": "44806",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44806/"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "USN-3658-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-3/"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          },
          {
            "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-1123",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T21:19:21.175738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T21:19:29.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng, procps",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-29T14:07:52.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "GLSA-201805-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201805-14"
        },
        {
          "name": "44806",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44806/"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "USN-3658-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-3/"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        },
        {
          "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1123",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng, procps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "3.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-122"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "GLSA-201805-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201805-14"
            },
            {
              "name": "44806",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44806/"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "USN-3658-3",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-3/"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            },
            {
              "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1123",
    "datePublished": "2018-05-23T14:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2025-12-17T21:19:29.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-1122 (GCVE-0-2018-1122)

Vulnerability from nvd – Published: 2018-05-23 14:00 – Updated: 2024-08-05 03:51
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.
Severity ?
7.3 (High)
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE
Assigner
References
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/201805-14 vendor-advisoryx_refsource_GENTOO
https://www.exploit-db.com/exploits/44806/ exploitx_refsource_EXPLOIT-DB
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3658-3/ vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:2189 vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2020:0595 vendor-advisoryx_refsource_REDHAT
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng, procps Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "GLSA-201805-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201805-14"
          },
          {
            "name": "44806",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44806/"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "USN-3658-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-3/"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "RHSA-2019:2189",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2189"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          },
          {
            "name": "RHSA-2020:0595",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0595"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng, procps",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-25T14:06:10.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "GLSA-201805-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201805-14"
        },
        {
          "name": "44806",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44806/"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "USN-3658-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-3/"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "RHSA-2019:2189",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2189"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        },
        {
          "name": "RHSA-2020:0595",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0595"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1122",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng, procps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-829"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "GLSA-201805-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201805-14"
            },
            {
              "name": "44806",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44806/"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "USN-3658-3",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-3/"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "RHSA-2019:2189",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2189"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            },
            {
              "name": "RHSA-2020:0595",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0595"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1122",
    "datePublished": "2018-05-23T14:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2024-08-05T03:51:48.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1126 (GCVE-0-2018-1126)

Vulnerability from nvd – Published: 2018-05-23 13:00 – Updated: 2025-12-17 20:45
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
Severity ?
4.8 (Medium)
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CWE
Assigner
References
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2018:1777 vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:2267 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2268 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:1700 vendor-advisoryx_refsource_REDHAT
https://help.ecostruxureit.com/display/public/UAD… x_refsource_CONFIRM
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1041057 vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2018:1820 vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://usn.ubuntu.com/3658-2/ vendor-advisoryx_refsource_UBUNTU
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:1944 vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng, procps Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.860Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "RHSA-2018:1777",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1777"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "RHSA-2018:2267",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2267"
          },
          {
            "name": "RHSA-2018:2268",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2268"
          },
          {
            "name": "RHSA-2018:1700",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1700"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "name": "1041057",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041057"
          },
          {
            "name": "RHSA-2018:1820",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1820"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126"
          },
          {
            "name": "USN-3658-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-2/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "RHSA-2019:1944",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1944"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-1126",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T20:45:38.465029Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T20:45:49.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng, procps",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-26T23:06:06.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "RHSA-2018:1777",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1777"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "RHSA-2018:2267",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2267"
        },
        {
          "name": "RHSA-2018:2268",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2268"
        },
        {
          "name": "RHSA-2018:1700",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1700"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "name": "1041057",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041057"
        },
        {
          "name": "RHSA-2018:1820",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1820"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126"
        },
        {
          "name": "USN-3658-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-2/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "RHSA-2019:1944",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1944"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1126",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng, procps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "4.8/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "RHSA-2018:1777",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1777"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "RHSA-2018:2267",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2267"
            },
            {
              "name": "RHSA-2018:2268",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2268"
            },
            {
              "name": "RHSA-2018:1700",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1700"
            },
            {
              "name": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0",
              "refsource": "CONFIRM",
              "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "1041057",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041057"
            },
            {
              "name": "RHSA-2018:1820",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1820"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126"
            },
            {
              "name": "USN-3658-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-2/"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "RHSA-2019:1944",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1944"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1126",
    "datePublished": "2018-05-23T13:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2025-12-17T20:45:49.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-1124 (GCVE-0-2018-1124)

Vulnerability from nvd – Published: 2018-05-23 13:00 – Updated: 2025-12-18 11:37
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.
Severity ?
7.3 (High)
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE
Assigner
References
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/201805-14 vendor-advisoryx_refsource_GENTOO
https://www.exploit-db.com/exploits/44806/ exploitx_refsource_EXPLOIT-DB
https://access.redhat.com/errata/RHSA-2018:1777 vendor-advisoryx_refsource_REDHAT
https://kc.mcafee.com/corporate/index?page=conten… x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:2267 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2268 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:1700 vendor-advisoryx_refsource_REDHAT
https://help.ecostruxureit.com/display/public/UAD… x_refsource_CONFIRM
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1041057 vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2018:1820 vendor-advisoryx_refsource_REDHAT
https://usn.ubuntu.com/3658-2/ vendor-advisoryx_refsource_UBUNTU
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:1944 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2401 vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.632Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1124"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "GLSA-201805-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201805-14"
          },
          {
            "name": "44806",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44806/"
          },
          {
            "name": "RHSA-2018:1777",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1777"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10241"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "RHSA-2018:2267",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2267"
          },
          {
            "name": "RHSA-2018:2268",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2268"
          },
          {
            "name": "RHSA-2018:1700",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1700"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "name": "1041057",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041057"
          },
          {
            "name": "RHSA-2018:1820",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1820"
          },
          {
            "name": "USN-3658-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-2/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "RHSA-2019:1944",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1944"
          },
          {
            "name": "RHSA-2019:2401",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2401"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-1124",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T22:12:23.097847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-18T11:37:47.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-26T23:06:10.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1124"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "GLSA-201805-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201805-14"
        },
        {
          "name": "44806",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44806/"
        },
        {
          "name": "RHSA-2018:1777",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1777"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10241"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "RHSA-2018:2267",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2267"
        },
        {
          "name": "RHSA-2018:2268",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2268"
        },
        {
          "name": "RHSA-2018:1700",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1700"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "name": "1041057",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041057"
        },
        {
          "name": "RHSA-2018:1820",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1820"
        },
        {
          "name": "USN-3658-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-2/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "RHSA-2019:1944",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1944"
        },
        {
          "name": "RHSA-2019:2401",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2401"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1124",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-122"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1124",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1124"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "GLSA-201805-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201805-14"
            },
            {
              "name": "44806",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44806/"
            },
            {
              "name": "RHSA-2018:1777",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1777"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10241",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10241"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "RHSA-2018:2267",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2267"
            },
            {
              "name": "RHSA-2018:2268",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2268"
            },
            {
              "name": "RHSA-2018:1700",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1700"
            },
            {
              "name": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0",
              "refsource": "CONFIRM",
              "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "1041057",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041057"
            },
            {
              "name": "RHSA-2018:1820",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1820"
            },
            {
              "name": "USN-3658-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-2/"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "RHSA-2019:1944",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1944"
            },
            {
              "name": "RHSA-2019:2401",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2401"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1124",
    "datePublished": "2018-05-23T13:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2025-12-18T11:37:47.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-1123 (GCVE-0-2018-1123)

Vulnerability from cvelistv5 – Published: 2018-05-23 14:00 – Updated: 2025-12-17 21:19
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).
Severity ?
3.9 (Low)
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CWE
Assigner
References
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/201805-14 vendor-advisoryx_refsource_GENTOO
https://www.exploit-db.com/exploits/44806/ exploitx_refsource_EXPLOIT-DB
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3658-3/ vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
https://lists.apache.org/thread.html/rf4c02775860… mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r58af02e294b… mailing-listx_refsource_MLIST
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng, procps Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.635Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "GLSA-201805-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201805-14"
          },
          {
            "name": "44806",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44806/"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "USN-3658-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-3/"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          },
          {
            "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-1123",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T21:19:21.175738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T21:19:29.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng, procps",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-29T14:07:52.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "GLSA-201805-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201805-14"
        },
        {
          "name": "44806",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44806/"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "USN-3658-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-3/"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        },
        {
          "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1123",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng, procps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "3.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-122"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "GLSA-201805-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201805-14"
            },
            {
              "name": "44806",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44806/"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "USN-3658-3",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-3/"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            },
            {
              "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1123",
    "datePublished": "2018-05-23T14:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2025-12-17T21:19:29.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-1125 (GCVE-0-2018-1125)

Vulnerability from cvelistv5 – Published: 2018-05-23 14:00 – Updated: 2025-12-17 22:09
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.
Severity ?
4.4 (Medium)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE
Assigner
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3658-3/ vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng, procps Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.542Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125"
          },
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "USN-3658-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-3/"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2018-1125",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T22:09:07.048887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-121",
                "description": "CWE-121 Stack-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T22:09:11.636Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng, procps",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-26T23:06:07.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125"
        },
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "USN-3658-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-3/"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1125",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng, procps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "4.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-121"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125"
            },
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "USN-3658-3",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-3/"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1125",
    "datePublished": "2018-05-23T14:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2025-12-17T22:09:11.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-1122 (GCVE-0-2018-1122)

Vulnerability from cvelistv5 – Published: 2018-05-23 14:00 – Updated: 2024-08-05 03:51
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.
Severity ?
7.3 (High)
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE
Assigner
References
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/201805-14 vendor-advisoryx_refsource_GENTOO
https://www.exploit-db.com/exploits/44806/ exploitx_refsource_EXPLOIT-DB
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3658-3/ vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:2189 vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
https://access.redhat.com/errata/RHSA-2020:0595 vendor-advisoryx_refsource_REDHAT
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng, procps Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "GLSA-201805-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201805-14"
          },
          {
            "name": "44806",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44806/"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "USN-3658-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-3/"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "RHSA-2019:2189",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2189"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          },
          {
            "name": "RHSA-2020:0595",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0595"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng, procps",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-25T14:06:10.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "GLSA-201805-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201805-14"
        },
        {
          "name": "44806",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44806/"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "USN-3658-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-3/"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "RHSA-2019:2189",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2189"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        },
        {
          "name": "RHSA-2020:0595",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0595"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1122",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng, procps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-829"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "GLSA-201805-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201805-14"
            },
            {
              "name": "44806",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44806/"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "USN-3658-3",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-3/"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "RHSA-2019:2189",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2189"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            },
            {
              "name": "RHSA-2020:0595",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0595"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1122",
    "datePublished": "2018-05-23T14:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2024-08-05T03:51:48.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-1124 (GCVE-0-2018-1124)

Vulnerability from cvelistv5 – Published: 2018-05-23 13:00 – Updated: 2025-12-18 11:37
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.
Severity ?
7.3 (High)
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE
Assigner
References
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/201805-14 vendor-advisoryx_refsource_GENTOO
https://www.exploit-db.com/exploits/44806/ exploitx_refsource_EXPLOIT-DB
https://access.redhat.com/errata/RHSA-2018:1777 vendor-advisoryx_refsource_REDHAT
https://kc.mcafee.com/corporate/index?page=conten… x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:2267 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2268 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:1700 vendor-advisoryx_refsource_REDHAT
https://help.ecostruxureit.com/display/public/UAD… x_refsource_CONFIRM
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1041057 vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2018:1820 vendor-advisoryx_refsource_REDHAT
https://usn.ubuntu.com/3658-2/ vendor-advisoryx_refsource_UBUNTU
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:1944 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2401 vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.632Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1124"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "GLSA-201805-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201805-14"
          },
          {
            "name": "44806",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44806/"
          },
          {
            "name": "RHSA-2018:1777",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1777"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10241"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "RHSA-2018:2267",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2267"
          },
          {
            "name": "RHSA-2018:2268",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2268"
          },
          {
            "name": "RHSA-2018:1700",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1700"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "name": "1041057",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041057"
          },
          {
            "name": "RHSA-2018:1820",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1820"
          },
          {
            "name": "USN-3658-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-2/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "RHSA-2019:1944",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1944"
          },
          {
            "name": "RHSA-2019:2401",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2401"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-1124",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T22:12:23.097847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-18T11:37:47.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-26T23:06:10.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1124"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "GLSA-201805-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201805-14"
        },
        {
          "name": "44806",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44806/"
        },
        {
          "name": "RHSA-2018:1777",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1777"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10241"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "RHSA-2018:2267",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2267"
        },
        {
          "name": "RHSA-2018:2268",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2268"
        },
        {
          "name": "RHSA-2018:1700",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1700"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "name": "1041057",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041057"
        },
        {
          "name": "RHSA-2018:1820",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1820"
        },
        {
          "name": "USN-3658-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-2/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "RHSA-2019:1944",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1944"
        },
        {
          "name": "RHSA-2019:2401",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2401"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1124",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-122"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1124",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1124"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "GLSA-201805-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201805-14"
            },
            {
              "name": "44806",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44806/"
            },
            {
              "name": "RHSA-2018:1777",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1777"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10241",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10241"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "RHSA-2018:2267",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2267"
            },
            {
              "name": "RHSA-2018:2268",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2268"
            },
            {
              "name": "RHSA-2018:1700",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1700"
            },
            {
              "name": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0",
              "refsource": "CONFIRM",
              "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "1041057",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041057"
            },
            {
              "name": "RHSA-2018:1820",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1820"
            },
            {
              "name": "USN-3658-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-2/"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "RHSA-2019:1944",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1944"
            },
            {
              "name": "RHSA-2019:2401",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2401"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1124",
    "datePublished": "2018-05-23T13:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2025-12-18T11:37:47.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-1126 (GCVE-0-2018-1126)

Vulnerability from cvelistv5 – Published: 2018-05-23 13:00 – Updated: 2025-12-17 20:45
VLAI?
Summary
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
Severity ?
4.8 (Medium)
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CWE
Assigner
References
https://usn.ubuntu.com/3658-1/ vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4208 vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2018:1777 vendor-advisoryx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2018:2267 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2268 vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:1700 vendor-advisoryx_refsource_REDHAT
https://help.ecostruxureit.com/display/public/UAD… x_refsource_CONFIRM
http://www.securityfocus.com/bid/104214 vdb-entryx_refsource_BID
http://seclists.org/oss-sec/2018/q2/122 mailing-listx_refsource_MLIST
http://www.securitytracker.com/id/1041057 vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2018:1820 vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… x_refsource_CONFIRM
https://usn.ubuntu.com/3658-2/ vendor-advisoryx_refsource_UBUNTU
https://www.qualys.com/2018/05/17/procps-ng-audit… x_refsource_MISC
https://access.redhat.com/errata/RHSA-2019:1944 vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
Impacted products
Vendor Product Version
[UNKNOWN] procps-ng, procps Affected: procps-ng 3.3.15
Create a notification for this product.
Date Public ?
2018-05-17 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.860Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3658-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-1/"
          },
          {
            "name": "DSA-4208",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4208"
          },
          {
            "name": "RHSA-2018:1777",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1777"
          },
          {
            "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
          },
          {
            "name": "RHSA-2018:2267",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2267"
          },
          {
            "name": "RHSA-2018:2268",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2268"
          },
          {
            "name": "RHSA-2018:1700",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1700"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
          },
          {
            "name": "104214",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104214"
          },
          {
            "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2018/q2/122"
          },
          {
            "name": "1041057",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041057"
          },
          {
            "name": "RHSA-2018:1820",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1820"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126"
          },
          {
            "name": "USN-3658-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3658-2/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
          },
          {
            "name": "RHSA-2019:1944",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1944"
          },
          {
            "name": "openSUSE-SU-2019:2376",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
          },
          {
            "name": "openSUSE-SU-2019:2379",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-1126",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T20:45:38.465029Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-17T20:45:49.505Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "procps-ng, procps",
          "vendor": "[UNKNOWN]",
          "versions": [
            {
              "status": "affected",
              "version": "procps-ng 3.3.15"
            }
          ]
        }
      ],
      "datePublic": "2018-05-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-26T23:06:06.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-3658-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-1/"
        },
        {
          "name": "DSA-4208",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4208"
        },
        {
          "name": "RHSA-2018:1777",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1777"
        },
        {
          "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
        },
        {
          "name": "RHSA-2018:2267",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2267"
        },
        {
          "name": "RHSA-2018:2268",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2268"
        },
        {
          "name": "RHSA-2018:1700",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1700"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
        },
        {
          "name": "104214",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104214"
        },
        {
          "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2018/q2/122"
        },
        {
          "name": "1041057",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041057"
        },
        {
          "name": "RHSA-2018:1820",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1820"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126"
        },
        {
          "name": "USN-3658-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3658-2/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
        },
        {
          "name": "RHSA-2019:1944",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1944"
        },
        {
          "name": "openSUSE-SU-2019:2376",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
        },
        {
          "name": "openSUSE-SU-2019:2379",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1126",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "procps-ng, procps",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "procps-ng 3.3.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "[UNKNOWN]"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124."
            }
          ]
        },
        "impact": {
          "cvss": [
            [
              {
                "vectorString": "4.8/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
                "version": "3.0"
              }
            ]
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3658-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-1/"
            },
            {
              "name": "DSA-4208",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4208"
            },
            {
              "name": "RHSA-2018:1777",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1777"
            },
            {
              "name": "[debian-lts-announce] 20180531 [SECURITY] [DLA 1390-1] procps security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html"
            },
            {
              "name": "RHSA-2018:2267",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2267"
            },
            {
              "name": "RHSA-2018:2268",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2268"
            },
            {
              "name": "RHSA-2018:1700",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1700"
            },
            {
              "name": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0",
              "refsource": "CONFIRM",
              "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
            },
            {
              "name": "104214",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104214"
            },
            {
              "name": "[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2018/q2/122"
            },
            {
              "name": "1041057",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041057"
            },
            {
              "name": "RHSA-2018:1820",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1820"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1126"
            },
            {
              "name": "USN-3658-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3658-2/"
            },
            {
              "name": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt",
              "refsource": "MISC",
              "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            },
            {
              "name": "RHSA-2019:1944",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1944"
            },
            {
              "name": "openSUSE-SU-2019:2376",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html"
            },
            {
              "name": "openSUSE-SU-2019:2379",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1126",
    "datePublished": "2018-05-23T13:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2025-12-17T20:45:49.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}