CVE-2018-14880

EPSS 0.99%
Published 03.10.2019 16:15:12
Last modified 21.11.2024 03:49:59
Source cve@mitre.org
Teams watchlist Login
Open Login

The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().

Affected products Warnungen 0 Metrics 3 CWE 1 References 20

Data is provided by the National Vulnerability Database (NVD)

Tcpdump ≫ Tcpdump Version < 4.9.3

Apple ≫ macOS X Version < 10.15.2

Debian ≫ Debian Linux Version8.0

Debian ≫ Debian Linux Version9.0

Debian ≫ Debian Linux Version10.0

Fedoraproject ≫ Fedora Version29

Fedoraproject ≫ Fedora Version30

Fedoraproject ≫ Fedora Version31

Opensuse ≫ Leap Version15.0

Opensuse ≫ Leap Version15.1

Redhat ≫ Enterprise Linux Version7.0

Redhat ≫ Enterprise Linux Version8.0

F5 ≫ Big-iq Centralized Management Version >= 5.2.0 <= 5.4.0

F5 ≫ Big-iq Centralized Management Version >= 6.0.0 <= 6.1.0

F5 ≫ Big-iq Centralized Management Version7.0.0

F5 ≫ Big-ip Access Policy Manager Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Access Policy Manager Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Access Policy Manager Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Access Policy Manager Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Access Policy Manager Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Advanced Firewall Manager Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Advanced Firewall Manager Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Advanced Firewall Manager Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Advanced Firewall Manager Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Analytics Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Analytics Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Analytics Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Analytics Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Analytics Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Application Acceleration Manager Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Application Acceleration Manager Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Application Acceleration Manager Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Application Acceleration Manager Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Application Acceleration Manager Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Application Security Manager Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Application Security Manager Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Application Security Manager Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Application Security Manager Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Application Security Manager Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Domain Name System Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Domain Name System Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Domain Name System Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Domain Name System Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Domain Name System Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Edge Gateway Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Edge Gateway Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Edge Gateway Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Edge Gateway Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Edge Gateway Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Fraud Protection Service Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Fraud Protection Service Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Fraud Protection Service Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Fraud Protection Service Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Fraud Protection Service Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Global Traffic Manager Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Global Traffic Manager Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Global Traffic Manager Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Global Traffic Manager Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Global Traffic Manager Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Link Controller Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Link Controller Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Link Controller Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Link Controller Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Link Controller Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Local Traffic Manager Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Local Traffic Manager Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Local Traffic Manager Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Local Traffic Manager Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Policy Enforcement Manager Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Policy Enforcement Manager Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Policy Enforcement Manager Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Policy Enforcement Manager Version >= 15.0.0 <= 15.0.1

F5 ≫ Big-ip Webaccelerator Version >= 11.5.2 <= 11.6.5

F5 ≫ Big-ip Webaccelerator Version >= 12.1.0 <= 12.1.5

F5 ≫ Big-ip Webaccelerator Version >= 13.1.0 <= 13.1.3

F5 ≫ Big-ip Webaccelerator Version >= 14.0.0 <= 14.1.2

F5 ≫ Big-ip Webaccelerator Version >= 15.0.0 <= 15.0.1

F5 ≫ Enterprise Manager Version3.1.1

F5 ≫ Iworkflow Version2.3.0

F5 ≫ Traffix Signaling Delivery Controller Version >= 5.0.0 <= 5.1.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.99%	0.759

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

http://seclists.org/fulldisclosure/2019/Dec/26

Third Party Advisory

Mailing List

https://seclists.org/bugtraq/2019/Dec/23

Third Party Advisory

Mailing List

https://support.apple.com/kb/HT210788

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html

Third Party Advisory

https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES

Third Party Advisory

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/

https://usn.ubuntu.com/4252-1/

https://usn.ubuntu.com/4252-2/

https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html

Third Party Advisory

https://seclists.org/bugtraq/2019/Oct/28

Third Party Advisory

Mailing List

https://security.netapp.com/advisory/ntap-20200120-0001/

https://www.debian.org/security/2019/dsa-4547

Third Party Advisory

https://github.com/the-tcpdump-group/tcpdump/commit/e01c9bf76740802025c9328901b55ee4a0c49ed6

Patch

Third Party Advisory

https://support.f5.com/csp/article/K56551263?utm_source=f5support&amp%3Butm_medium=RSS

https://nvd.nist.gov/vuln/detail/CVE-2018-14880

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-14880

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-14880

EUVD