Vulnerability-Lookup

BDU:2018-00525 (CVE-2018-7584)

Vulnerability from fstec – Published: 2018-04-12 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции php_stream_url_wrap_http_ex интерпретатора PHP, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании

Summary

Уязвимость функции php_stream_url_wrap_http_ex (ext/standard/http_fopen_wrapper.c) интерпретатора PHP вызвана выходом операции за границы буфера на стеке. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код или вызвать отказ в обслуживании с использованием специально сформированного HTTP-ответа

Severity

7.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 (Critical) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-119 - Выход операции за границы буфера в памяти

Aliases

CVE-2018-7584, USN-3600-1, BID, ID:103204

References

9 references

URL
http://php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/103204
https://bugs.php.net/bug.php?id=75981
https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba
https://lists.debian.org/debian-lts-announce/2018/03/msg00030.html
https://www.tenable.com/security/tns-2018-03
https://usn.ubuntu.com/3600-1/
https://nvd.nist.gov/vuln/detail/CVE-2018-7584
https://security-tracker.debian.org/tracker/CVE-2018-7584

Impacted products

2 products from 2 vendors

Vendors

PHP Group, ООО «РусБИТех-Астра»

Products

PHP, Astra Linux Special Edition (запись в едином реестре российских программ №369)

Versions

5.6.33 (PHP), от 7.0.0 до 7.0.28 (PHP), от 7.1.0 до 7.1.14 включительно (PHP), от 7.2.0 до 7.2.2 включительно (PHP), 1.6 «Смоленск» (Astra Linux Special Edition)

Product types

Application software, Operating system

Mitigations

Для PHP: Обновление программного обеспечения до 7.2.3 или более поздней версии Использование рекомендаций: http://php.net/ChangeLog-7.php https://bugs.php.net/bug.php?id=75981 https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba Для Astra Linux: Обновление программного обеспечения (пакета php7.0) до 7.0.30-0+deb9u1 или более поздней версии

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "PHP Group, \u041e\u041e\u041e \u00ab\u0420\u0443\u0441\u0411\u0418\u0422\u0435\u0445-\u0410\u0441\u0442\u0440\u0430\u00bb",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "5.6.33 (PHP), \u043e\u0442 7.0.0 \u0434\u043e 7.0.28 (PHP), \u043e\u0442 7.1.0 \u0434\u043e 7.1.14 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (PHP), \u043e\u0442 7.2.0 \u0434\u043e 7.2.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (PHP), 1.6 \u00ab\u0421\u043c\u043e\u043b\u0435\u043d\u0441\u043a\u00bb (Astra Linux Special Edition)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0414\u043b\u044f PHP:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e 7.2.3 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttp://php.net/ChangeLog-7.php\nhttps://bugs.php.net/bug.php?id=75981\nhttps://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba\n\n\u0414\u043b\u044f Astra Linux:\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f (\u043f\u0430\u043a\u0435\u0442\u0430 php7.0) \u0434\u043e 7.0.30-0+deb9u1 \u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "01.03.2018",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "12.04.2018",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2018-00525",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2018-7584, USN-3600-1, BID ID:103204",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "PHP, Astra Linux Special Edition (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2116369)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 php_stream_url_wrap_http_ex \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 PHP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0412\u044b\u0445\u043e\u0434 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 (CWE-119)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 php_stream_url_wrap_http_ex (ext/standard/http_fopen_wrapper.c) \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 PHP \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0430 \u0441\u0442\u0435\u043a\u0435. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e HTTP-\u043e\u0442\u0432\u0435\u0442\u0430",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://php.net/ChangeLog-7.php\n\nhttp://www.securityfocus.com/bid/103204\n\nhttps://bugs.php.net/bug.php?id=75981\n\nhttps://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba\n\nhttps://lists.debian.org/debian-lts-announce/2018/03/msg00030.html\nhttps://www.tenable.com/security/tns-2018-03\nhttps://usn.ubuntu.com/3600-1/\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-7584\nhttps://security-tracker.debian.org/tracker/CVE-2018-7584",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-119",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

CVE-2018-7584 (GCVE-0-2018-7584)

Vulnerability from cvelistv5 – Published: 2018-03-01 18:00 – Updated: 2024-08-05 06:31

Summary

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

14 references

URL	Tags
https://usn.ubuntu.com/3600-1/	vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4240	vendor-advisoryx_refsource_DEBIAN
https://bugs.php.net/bug.php?id=75981	x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://www.tenable.com/security/tns-2018-12	x_refsource_CONFIRM
https://www.tenable.com/security/tns-2018-03	x_refsource_CONFIRM
http://www.securitytracker.com/id/1041607	vdb-entryx_refsource_SECTRACK
https://github.com/php/php-src/commit/523f230c831…	x_refsource_CONFIRM
https://www.exploit-db.com/exploits/44846/	exploitx_refsource_EXPLOIT-DB
http://php.net/ChangeLog-7.php	x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST
https://usn.ubuntu.com/3600-2/	vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/103204	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2019:2519	vendor-advisoryx_refsource_REDHAT

Date Public

2018-03-01 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:31:04.995Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3600-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3600-1/"
          },
          {
            "name": "DSA-4240",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4240"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=75981"
          },
          {
            "name": "[debian-lts-announce] 20180329 [SECURITY] [DLA 1326-1] php5 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00030.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2018-12"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2018-03"
          },
          {
            "name": "1041607",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041607"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba"
          },
          {
            "name": "44846",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44846/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://php.net/ChangeLog-7.php"
          },
          {
            "name": "[debian-lts-announce] 20180626 [SECURITY] [DLA 1397-1] php5 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html"
          },
          {
            "name": "USN-3600-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3600-2/"
          },
          {
            "name": "103204",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103204"
          },
          {
            "name": "RHSA-2019:2519",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2519"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-03-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-19T10:06:06.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3600-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3600-1/"
        },
        {
          "name": "DSA-4240",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4240"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.php.net/bug.php?id=75981"
        },
        {
          "name": "[debian-lts-announce] 20180329 [SECURITY] [DLA 1326-1] php5 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00030.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2018-12"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2018-03"
        },
        {
          "name": "1041607",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041607"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba"
        },
        {
          "name": "44846",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44846/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://php.net/ChangeLog-7.php"
        },
        {
          "name": "[debian-lts-announce] 20180626 [SECURITY] [DLA 1397-1] php5 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html"
        },
        {
          "name": "USN-3600-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3600-2/"
        },
        {
          "name": "103204",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103204"
        },
        {
          "name": "RHSA-2019:2519",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-7584",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3600-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3600-1/"
            },
            {
              "name": "DSA-4240",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4240"
            },
            {
              "name": "https://bugs.php.net/bug.php?id=75981",
              "refsource": "CONFIRM",
              "url": "https://bugs.php.net/bug.php?id=75981"
            },
            {
              "name": "[debian-lts-announce] 20180329 [SECURITY] [DLA 1326-1] php5 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00030.html"
            },
            {
              "name": "https://www.tenable.com/security/tns-2018-12",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2018-12"
            },
            {
              "name": "https://www.tenable.com/security/tns-2018-03",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2018-03"
            },
            {
              "name": "1041607",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041607"
            },
            {
              "name": "https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba",
              "refsource": "CONFIRM",
              "url": "https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba"
            },
            {
              "name": "44846",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44846/"
            },
            {
              "name": "http://php.net/ChangeLog-7.php",
              "refsource": "CONFIRM",
              "url": "http://php.net/ChangeLog-7.php"
            },
            {
              "name": "[debian-lts-announce] 20180626 [SECURITY] [DLA 1397-1] php5 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html"
            },
            {
              "name": "USN-3600-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3600-2/"
            },
            {
              "name": "103204",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103204"
            },
            {
              "name": "RHSA-2019:2519",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2519"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-7584",
    "datePublished": "2018-03-01T18:00:00.000Z",
    "dateReserved": "2018-03-01T00:00:00.000Z",
    "dateUpdated": "2024-08-05T06:31:04.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-3600-1

Vulnerability from osv_ubuntu

Published

2018-03-19 11:53

Modified

2026-04-22 07:36

Summary

php5, php7.0, php7.1 vulnerabilities

Details

It was discovered that PHP incorrectly handled certain stream metadata. A remote attacker could possibly use this issue to set arbitrary metadata. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-10712)

It was discovered that PHP incorrectly handled the PHAR 404 error page. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-5712)

It was discovered that PHP incorrectly handled parsing certain HTTP responses. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-7584)

References

URL

Type

	https://ubuntu.com/security/notices/USN-3600-1	ADVISORY
	https://ubuntu.com/security/CVE-2016-10712	REPORT
	https://ubuntu.com/security/CVE-2018-5712	REPORT
	https://ubuntu.com/security/CVE-2018-7584	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-10712",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-7584",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libapache2-mod-php5",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "libapache2-mod-php5filter",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "libphp5-embed",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php-pear",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-cgi",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-cli",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-common",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-curl",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-enchant",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-fpm",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-gd",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-gmp",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-intl",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-ldap",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-mysql",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-mysqlnd",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-odbc",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-pgsql",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-pspell",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-readline",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-recode",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-snmp",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-sqlite",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-sybase",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-tidy",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-xmlrpc",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          },
          {
            "binary_name": "php5-xsl",
            "binary_version": "5.5.9+dfsg-1ubuntu4.24"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "php5",
        "purl": "pkg:deb/ubuntu/php5@5.5.9+dfsg-1ubuntu4.24?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.9+dfsg-1ubuntu4.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.5.3+dfsg-1ubuntu2",
        "5.5.3+dfsg-1ubuntu3",
        "5.5.6+dfsg-1ubuntu1",
        "5.5.6+dfsg-1ubuntu2",
        "5.5.8+dfsg-2ubuntu1",
        "5.5.9+dfsg-1ubuntu1",
        "5.5.9+dfsg-1ubuntu2",
        "5.5.9+dfsg-1ubuntu3",
        "5.5.9+dfsg-1ubuntu4",
        "5.5.9+dfsg-1ubuntu4.1",
        "5.5.9+dfsg-1ubuntu4.2",
        "5.5.9+dfsg-1ubuntu4.3",
        "5.5.9+dfsg-1ubuntu4.4",
        "5.5.9+dfsg-1ubuntu4.5",
        "5.5.9+dfsg-1ubuntu4.6",
        "5.5.9+dfsg-1ubuntu4.7",
        "5.5.9+dfsg-1ubuntu4.9",
        "5.5.9+dfsg-1ubuntu4.11",
        "5.5.9+dfsg-1ubuntu4.12",
        "5.5.9+dfsg-1ubuntu4.13",
        "5.5.9+dfsg-1ubuntu4.14",
        "5.5.9+dfsg-1ubuntu4.16",
        "5.5.9+dfsg-1ubuntu4.17",
        "5.5.9+dfsg-1ubuntu4.19",
        "5.5.9+dfsg-1ubuntu4.20",
        "5.5.9+dfsg-1ubuntu4.21",
        "5.5.9+dfsg-1ubuntu4.22",
        "5.5.9+dfsg-1ubuntu4.23"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2018-5712",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2018-7584",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libapache2-mod-php7.0",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "libphp7.0-embed",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-bcmath",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-bz2",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-cgi",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-cli",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-common",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-curl",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-dba",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-enchant",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-fpm",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-gd",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-gmp",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-imap",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-interbase",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-intl",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-json",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-ldap",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-mbstring",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-mcrypt",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-mysql",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-odbc",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-opcache",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-pgsql",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-phpdbg",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-pspell",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-readline",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-recode",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-snmp",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-soap",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-sqlite3",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-sybase",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-tidy",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-xml",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-xmlrpc",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-xsl",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          },
          {
            "binary_name": "php7.0-zip",
            "binary_version": "7.0.28-0ubuntu0.16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "php7.0",
        "purl": "pkg:deb/ubuntu/php7.0@7.0.28-0ubuntu0.16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.28-0ubuntu0.16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.1-5",
        "7.0.1-6",
        "7.0.2-1",
        "7.0.2-3",
        "7.0.2-4",
        "7.0.2-5",
        "7.0.3-2",
        "7.0.3-3",
        "7.0.3-9ubuntu1",
        "7.0.4-5ubuntu1",
        "7.0.4-5ubuntu2",
        "7.0.4-7ubuntu1",
        "7.0.4-7ubuntu2",
        "7.0.4-7ubuntu2.1",
        "7.0.8-0ubuntu0.16.04.1",
        "7.0.8-0ubuntu0.16.04.2",
        "7.0.8-0ubuntu0.16.04.3",
        "7.0.13-0ubuntu0.16.04.1",
        "7.0.15-0ubuntu0.16.04.1",
        "7.0.15-0ubuntu0.16.04.2",
        "7.0.15-0ubuntu0.16.04.4",
        "7.0.18-0ubuntu0.16.04.1",
        "7.0.22-0ubuntu0.16.04.1",
        "7.0.25-0ubuntu0.16.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that PHP incorrectly handled certain stream metadata. A\nremote attacker could possibly use this issue to set arbitrary metadata.\nThis issue only affected Ubuntu 14.04 LTS. (CVE-2016-10712)\n\nIt was discovered that PHP incorrectly handled the PHAR 404 error page. A\nremote attacker could possibly use this issue to conduct cross-site\nscripting (XSS) attacks. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 17.10. (CVE-2018-5712)\n\nIt was discovered that PHP incorrectly handled parsing certain HTTP\nresponses. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2018-7584)\n",
  "id": "USN-3600-1",
  "modified": "2026-04-22T07:36:35Z",
  "published": "2018-03-19T11:53:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3600-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10712"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-5712"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2018-7584"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "php5, php7.0, php7.1 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-10712",
    "UBUNTU-CVE-2018-5712",
    "UBUNTU-CVE-2018-7584"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2018-00525 (CVE-2018-7584)

CVE-2018-7584 (GCVE-0-2018-7584)

usn-3600-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour