Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2018-14462
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T09:29:51.278Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3" }, { "name": "[debian-lts-announce] 20191011 [SECURITY] [DLA 1955-1] tcpdump security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html" }, { "name": "openSUSE-SU-2019:2344", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html" }, { "name": "openSUSE-SU-2019:2348", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html" }, { "name": "20191021 [SECURITY] [DSA 4547-1] tcpdump security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/Oct/28" }, { "name": "DSA-4547", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2019/dsa-4547" }, { "name": "FEDORA-2019-85d92df70f", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/" }, { "name": "FEDORA-2019-d06bc63433", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/" }, { "name": "FEDORA-2019-6db0d5b9d9", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://support.apple.com/kb/HT210788" }, { "name": "20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/Dec/23" }, { "name": "20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "tags": [ "mailing-list", "x_refsource_FULLDISC", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2019/Dec/26" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20200120-0001/" }, { "name": "USN-4252-2", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/4252-2/" }, { "name": "USN-4252-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/4252-1/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print()." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-02-05T03:06:19", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3" }, { "name": "[debian-lts-announce] 20191011 [SECURITY] [DLA 1955-1] tcpdump security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html" }, { "name": "openSUSE-SU-2019:2344", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html" }, { "name": "openSUSE-SU-2019:2348", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html" }, { "name": "20191021 [SECURITY] [DSA 4547-1] tcpdump security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "https://seclists.org/bugtraq/2019/Oct/28" }, { "name": "DSA-4547", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2019/dsa-4547" }, { "name": "FEDORA-2019-85d92df70f", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/" }, { "name": "FEDORA-2019-d06bc63433", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/" }, { "name": "FEDORA-2019-6db0d5b9d9", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://support.apple.com/kb/HT210788" }, { "name": "20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "https://seclists.org/bugtraq/2019/Dec/23" }, { "name": "20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "tags": [ "mailing-list", "x_refsource_FULLDISC" ], "url": "http://seclists.org/fulldisclosure/2019/Dec/26" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20200120-0001/" }, { "name": "USN-4252-2", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/4252-2/" }, { "name": "USN-4252-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/4252-1/" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-14462", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print()." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES", "refsource": "MISC", "url": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES" }, { "name": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3", "refsource": "CONFIRM", "url": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3" }, { "name": "[debian-lts-announce] 20191011 [SECURITY] [DLA 1955-1] tcpdump security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html" }, { "name": "openSUSE-SU-2019:2344", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html" }, { "name": "openSUSE-SU-2019:2348", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html" }, { "name": "20191021 [SECURITY] [DSA 4547-1] tcpdump security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Oct/28" }, { "name": "DSA-4547", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4547" }, { "name": "FEDORA-2019-85d92df70f", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/" }, { "name": "FEDORA-2019-d06bc63433", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/" }, { "name": "FEDORA-2019-6db0d5b9d9", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/" }, { "name": "https://support.apple.com/kb/HT210788", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT210788" }, { "name": "20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Dec/23" }, { "name": "20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2019/Dec/26" }, { "name": "https://security.netapp.com/advisory/ntap-20200120-0001/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20200120-0001/" }, { "name": "USN-4252-2", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4252-2/" }, { "name": "USN-4252-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4252-1/" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-14462", "datePublished": "2019-10-03T15:11:19", "dateReserved": "2018-07-20T00:00:00", "dateUpdated": "2024-08-05T09:29:51.278Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2018-14462\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-10-03T16:15:11.490\",\"lastModified\":\"2024-11-21T03:49:07.383\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().\"},{\"lang\":\"es\",\"value\":\"El analizador ICMP en tcpdump versiones anteriores a 4.9.3, presenta una lectura excesiva del b\u00fafer en print-icmp.c:icmp_print().\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tcpdump:tcpdump:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.9.3\",\"matchCriteriaId\":\"CA59BD9C-6C0C-4584-A8CC-8C652E9D36AF\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndIncluding\":\"5.1.0\",\"matchCriteriaId\":\"4E52F91D-3F39-4D89-8069-EC422FB1F700\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tcpdump:tcpdump:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.9.3\",\"matchCriteriaId\":\"CA59BD9C-6C0C-4584-A8CC-8C652E9D36AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.15.2\",\"matchCriteriaId\":\"F15588EA-D854-4694-97C6-53D9AA8B6F2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D100F7CE-FC64-4CC6-852A-6136D72DA419\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97A4B8DF-58DA-4AB6-A1F9-331B36409BA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1E78106-58E6-4D59-990F-75DA575BFAD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B620311B-34A3-48A6-82DF-6F078D7A4493\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2019/Dec/26\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://seclists.org/bugtraq/2019/Dec/23\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/Oct/28\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200120-0001/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://support.apple.com/kb/HT210788\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4252-1/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://usn.ubuntu.com/4252-2/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4547\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2019/Dec/26\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://seclists.org/bugtraq/2019/Dec/23\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/Oct/28\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200120-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://support.apple.com/kb/HT210788\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4252-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/4252-2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4547\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
ghsa-4f2v-4fxm-hw3f
Vulnerability from github
The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().
{ "affected": [], "aliases": [ "CVE-2018-14462" ], "database_specific": { "cwe_ids": [ "CWE-125" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2019-10-03T16:15:00Z", "severity": "MODERATE" }, "details": "The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().", "id": "GHSA-4f2v-4fxm-hw3f", "modified": "2023-08-16T15:30:14Z", "published": "2022-05-24T16:57:43Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14462" }, { "type": "WEB", "url": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3" }, { "type": "WEB", "url": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/Dec/23" }, { "type": "WEB", "url": "https://seclists.org/bugtraq/2019/Oct/28" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20200120-0001" }, { "type": "WEB", "url": "https://support.apple.com/kb/HT210788" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4252-1" }, { "type": "WEB", "url": "https://usn.ubuntu.com/4252-2" }, { "type": "WEB", "url": "https://www.debian.org/security/2019/dsa-4547" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2019/Dec/26" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ] }
rhsa-2020_4760
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for tcpdump is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces.\n\nThe following packages have been upgraded to a later upstream version: tcpdump (4.9.3). (BZ#1804063)\n\nSecurity Fix(es):\n\n* tcpdump: SMB data printing mishandled (CVE-2018-10103)\n\n* tcpdump: SMB data printing mishandled (CVE-2018-10105)\n\n* tcpdump: Out of bounds read/write in get_next_file() in tcpdump.c (CVE-2018-14879)\n\n* tcpdump: Buffer over-read in ldp_tlv_print() function in print-ldp.c (CVE-2018-14461)\n\n* tcpdump: Buffer over-read in icmp_print() function in print-icmp.c (CVE-2018-14462)\n\n* tcpdump: Buffer over-read in vrrp_print() function in print-vrrp.c (CVE-2018-14463)\n\n* tcpdump: Buffer over-read in lmp_print_data_link_subobjs() function in print-lmp.c (CVE-2018-14464)\n\n* tcpdump: Buffer over-read in rsvp_obj_print() function in print-rsvp.c (CVE-2018-14465)\n\n* tcpdump: Buffer over-read in print-icmp6.c (CVE-2018-14466)\n\n* tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c (CVE-2018-14467)\n\n* tcpdump: Buffer over-read in mfr_print() function in print-fr.c (CVE-2018-14468)\n\n* tcpdump: Buffer over-read in ikev1_n_print() function in print-isakmp.c (CVE-2018-14469)\n\n* tcpdump: Buffer over-read in babel_print_v2() in print-babel.c (CVE-2018-14470)\n\n* tcpdump: Buffer over-read in ospf6_print_lshdr() function in print-ospf6.c (CVE-2018-14880)\n\n* tcpdump: Buffer over-read in bgp_capabilities_print() function in print-bgp.c (CVE-2018-14881)\n\n* tcpdump: Buffer over-read in function rpl_dio_printopt in print-icmp6.c (CVE-2018-14882)\n\n* tcpdump: Buffer over-read in print-802_11.c (CVE-2018-16227)\n\n* tcpdump: Access to uninitialized buffer in print_prefix() function in print-hncp.c (CVE-2018-16228)\n\n* tcpdump: Buffer over-read in dccp_print_option() function in print-dccp.c (CVE-2018-16229)\n\n* tcpdump: Buffer over-read in bgp_attr_print() function in print-bgp.c (CVE-2018-16230)\n\n* tcpdump: Resource exhaustion in bgp_attr_print() function in print-bgp.c (CVE-2018-16300)\n\n* tcpdump: Buffer over-read in print_trans() function in print-smb.c (CVE-2018-16451)\n\n* tcpdump: Resource exhaustion in smb_fdata() funtion in smbutil.c (CVE-2018-16452)\n\n* tcpdump: Buffer overflow in lmp_print_data_link_subobjs() in print-lmp.c (CVE-2019-15166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4760", "url": "https://access.redhat.com/errata/RHSA-2020:4760" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/" }, { "category": "external", "summary": "1760430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760430" }, { "category": "external", "summary": "1760445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760445" }, { "category": "external", "summary": "1760447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760447" }, { "category": "external", "summary": "1760449", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760449" }, { "category": "external", "summary": "1760453", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760453" }, { "category": "external", "summary": "1760455", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760455" }, { "category": "external", "summary": "1760457", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760457" }, { "category": "external", "summary": "1760458", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760458" }, { "category": "external", "summary": "1760461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760461" }, { "category": "external", "summary": "1760463", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760463" }, { "category": "external", "summary": "1760464", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760464" }, { "category": "external", "summary": "1760468", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760468" }, { "category": "external", "summary": "1760504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760504" }, { "category": "external", "summary": "1760505", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760505" }, { "category": "external", "summary": "1760506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760506" }, { "category": "external", "summary": "1760507", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760507" }, { "category": "external", "summary": "1760509", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760509" }, { "category": "external", "summary": "1760512", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760512" }, { "category": "external", "summary": "1760513", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760513" }, { "category": "external", "summary": "1760514", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760514" }, { "category": "external", "summary": "1760516", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760516" }, { "category": "external", "summary": "1760517", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760517" }, { "category": "external", "summary": "1760518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760518" }, { "category": "external", "summary": "1760520", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760520" }, { "category": "external", "summary": "1804063", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1804063" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4760.json" } ], "title": "Red Hat Security Advisory: tcpdump security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T15:18:21+00:00", "generator": { "date": "2024-11-22T15:18:21+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4760", "initial_release_date": "2020-11-04T01:47:16+00:00", "revision_history": [ { "date": "2020-11-04T01:47:16+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-04T01:47:16+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:18:21+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "tcpdump-14:4.9.3-1.el8.ppc64le", "product": { "name": "tcpdump-14:4.9.3-1.el8.ppc64le", "product_id": "tcpdump-14:4.9.3-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump@4.9.3-1.el8?arch=ppc64le\u0026epoch=14" } } }, { "category": "product_version", "name": "tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "product": { "name": "tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "product_id": "tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump-debugsource@4.9.3-1.el8?arch=ppc64le\u0026epoch=14" } } }, { "category": "product_version", "name": "tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "product": { "name": "tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "product_id": "tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump-debuginfo@4.9.3-1.el8?arch=ppc64le\u0026epoch=14" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "tcpdump-14:4.9.3-1.el8.s390x", "product": { "name": "tcpdump-14:4.9.3-1.el8.s390x", "product_id": "tcpdump-14:4.9.3-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump@4.9.3-1.el8?arch=s390x\u0026epoch=14" } } }, { "category": "product_version", "name": "tcpdump-debugsource-14:4.9.3-1.el8.s390x", "product": { "name": "tcpdump-debugsource-14:4.9.3-1.el8.s390x", "product_id": "tcpdump-debugsource-14:4.9.3-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump-debugsource@4.9.3-1.el8?arch=s390x\u0026epoch=14" } } }, { "category": "product_version", "name": "tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "product": { "name": "tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "product_id": "tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump-debuginfo@4.9.3-1.el8?arch=s390x\u0026epoch=14" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "tcpdump-14:4.9.3-1.el8.x86_64", "product": { "name": "tcpdump-14:4.9.3-1.el8.x86_64", "product_id": "tcpdump-14:4.9.3-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump@4.9.3-1.el8?arch=x86_64\u0026epoch=14" } } }, { "category": "product_version", "name": "tcpdump-debugsource-14:4.9.3-1.el8.x86_64", "product": { "name": "tcpdump-debugsource-14:4.9.3-1.el8.x86_64", "product_id": "tcpdump-debugsource-14:4.9.3-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump-debugsource@4.9.3-1.el8?arch=x86_64\u0026epoch=14" } } }, { "category": "product_version", "name": "tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "product": { "name": "tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "product_id": "tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump-debuginfo@4.9.3-1.el8?arch=x86_64\u0026epoch=14" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "tcpdump-14:4.9.3-1.el8.aarch64", "product": { "name": "tcpdump-14:4.9.3-1.el8.aarch64", "product_id": "tcpdump-14:4.9.3-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump@4.9.3-1.el8?arch=aarch64\u0026epoch=14" } } }, { "category": "product_version", "name": "tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "product": { "name": "tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "product_id": "tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump-debugsource@4.9.3-1.el8?arch=aarch64\u0026epoch=14" } } }, { "category": "product_version", "name": "tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "product": { "name": "tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "product_id": "tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump-debuginfo@4.9.3-1.el8?arch=aarch64\u0026epoch=14" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "tcpdump-14:4.9.3-1.el8.src", "product": { "name": "tcpdump-14:4.9.3-1.el8.src", "product_id": "tcpdump-14:4.9.3-1.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tcpdump@4.9.3-1.el8?arch=src\u0026epoch=14" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "tcpdump-14:4.9.3-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64" }, "product_reference": "tcpdump-14:4.9.3-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-14:4.9.3-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le" }, "product_reference": "tcpdump-14:4.9.3-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-14:4.9.3-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x" }, "product_reference": "tcpdump-14:4.9.3-1.el8.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-14:4.9.3-1.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src" }, "product_reference": "tcpdump-14:4.9.3-1.el8.src", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-14:4.9.3-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64" }, "product_reference": "tcpdump-14:4.9.3-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-debuginfo-14:4.9.3-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64" }, "product_reference": "tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le" }, "product_reference": "tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-debuginfo-14:4.9.3-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x" }, "product_reference": "tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-debuginfo-14:4.9.3-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64" }, "product_reference": "tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-debugsource-14:4.9.3-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64" }, "product_reference": "tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-debugsource-14:4.9.3-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le" }, "product_reference": "tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-debugsource-14:4.9.3-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x" }, "product_reference": "tcpdump-debugsource-14:4.9.3-1.el8.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "tcpdump-debugsource-14:4.9.3-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" }, "product_reference": "tcpdump-debugsource-14:4.9.3-1.el8.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-10103", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760504" } ], "notes": [ { "category": "description", "text": "tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: SMB data printing mishandled", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-10103" }, { "category": "external", "summary": "RHBZ#1760504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760504" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-10103", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10103" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10103", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10103" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tcpdump: SMB data printing mishandled" }, { "cve": "CVE-2018-10105", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760505" } ], "notes": [ { "category": "description", "text": "tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: SMB data printing mishandled", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-10105" }, { "category": "external", "summary": "RHBZ#1760505", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760505" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-10105", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10105" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10105", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10105" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tcpdump: SMB data printing mishandled" }, { "cve": "CVE-2018-14461", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760506" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing LDP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in ldp_tlv_print() function in print-ldp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14461" }, { "category": "external", "summary": "RHBZ#1760506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14461", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14461" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14461", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14461" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in ldp_tlv_print() function in print-ldp.c" }, { "cve": "CVE-2018-14462", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760455" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read flaw was discovered in tcpdump while printing ICMP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application. System availability is the highest threat from this vulnerability", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in icmp_print() function in print-icmp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14462" }, { "category": "external", "summary": "RHBZ#1760455", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760455" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14462", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14462" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14462", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14462" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in icmp_print() function in print-icmp.c" }, { "cve": "CVE-2018-14463", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760453" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing VRRP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in vrrp_print() function in print-vrrp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14463" }, { "category": "external", "summary": "RHBZ#1760453", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760453" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14463", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14463" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14463", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14463" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in vrrp_print() function in print-vrrp.c" }, { "cve": "CVE-2018-14464", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760507" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing LMP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in lmp_print_data_link_subobjs() function in print-lmp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14464" }, { "category": "external", "summary": "RHBZ#1760507", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760507" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14464", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14464" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14464", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14464" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in lmp_print_data_link_subobjs() function in print-lmp.c" }, { "cve": "CVE-2018-14465", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760449" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing RSVP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in rsvp_obj_print() function in print-rsvp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14465" }, { "category": "external", "summary": "RHBZ#1760449", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760449" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14465", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14465" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14465", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14465" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in rsvp_obj_print() function in print-rsvp.c" }, { "cve": "CVE-2018-14466", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760509" } ], "notes": [ { "category": "description", "text": "The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in print-icmp6.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14466" }, { "category": "external", "summary": "RHBZ#1760509", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760509" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14466", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14466" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14466", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14466" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in print-icmp6.c" }, { "cve": "CVE-2018-14467", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760512" } ], "notes": [ { "category": "description", "text": "The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14467" }, { "category": "external", "summary": "RHBZ#1760512", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760512" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14467", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14467" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14467", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14467" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c" }, { "cve": "CVE-2018-14468", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760464" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing FRF.16 packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in mfr_print() function in print-fr.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14468" }, { "category": "external", "summary": "RHBZ#1760464", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760464" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14468", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14468" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14468", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14468" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in mfr_print() function in print-fr.c" }, { "cve": "CVE-2018-14469", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760447" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing ISAKMP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in ikev1_n_print() function in print-isakmp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14469" }, { "category": "external", "summary": "RHBZ#1760447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760447" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14469", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14469" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14469", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14469" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in ikev1_n_print() function in print-isakmp.c" }, { "cve": "CVE-2018-14470", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760513" } ], "notes": [ { "category": "description", "text": "The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in babel_print_v2() in print-babel.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14470" }, { "category": "external", "summary": "RHBZ#1760513", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760513" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14470", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14470" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14470", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14470" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in babel_print_v2() in print-babel.c" }, { "cve": "CVE-2018-14879", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760457" } ], "notes": [ { "category": "description", "text": "An out-of-bounds write vulnerability was discovered in tcpdump while reading the file passed to the -V option of the command line program. An attacker may abuse this flaw by tricking a victim user into using a malicious file with the -V option, which would make the program read one byte before a stack-based allocated buffer and potentially write a NULL byte to it.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Out of bounds read/write in in get_next_file() in tcpdump.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14879" }, { "category": "external", "summary": "RHBZ#1760457", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760457" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14879", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14879" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14879", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14879" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "tcpdump: Out of bounds read/write in in get_next_file() in tcpdump.c" }, { "cve": "CVE-2018-14880", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760468" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing OSPFv3 packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in ospf6_print_lshdr() function in print-ospf6.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14880" }, { "category": "external", "summary": "RHBZ#1760468", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760468" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14880", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14880" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14880", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14880" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in ospf6_print_lshdr() function in print-ospf6.c" }, { "cve": "CVE-2018-14881", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760463" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing BGP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in bgp_capabilities_print() function in print-bgp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14881" }, { "category": "external", "summary": "RHBZ#1760463", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760463" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14881", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14881" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14881", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14881" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in bgp_capabilities_print() function in print-bgp.c" }, { "cve": "CVE-2018-14882", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760430" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing ICMP6 packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in function rpl_dio_printopt in print-icmp6.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14882" }, { "category": "external", "summary": "RHBZ#1760430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760430" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14882", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14882" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14882", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14882" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in function rpl_dio_printopt in print-icmp6.c" }, { "cve": "CVE-2018-16227", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760461" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing IEEE 802.11 packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in print-802_11.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16227" }, { "category": "external", "summary": "RHBZ#1760461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760461" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16227", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16227" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16227", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16227" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in print-802_11.c" }, { "cve": "CVE-2018-16228", "cwe": { "id": "CWE-665", "name": "Improper Initialization" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760514" } ], "notes": [ { "category": "description", "text": "A flaw was found in tcpdump where an uninitialized buffer is accessed in tcpdump while printing HNCP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application. System availability is the highest threat from this vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Access to uninitialized buffer in print_prefix() function in print-hncp.c", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue does not affect the versions of tcpdump as shipped with Red Hat Enterprise Linux 7 as they already include the patch.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16228" }, { "category": "external", "summary": "RHBZ#1760514", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760514" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16228", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16228" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16228", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16228" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Access to uninitialized buffer in print_prefix() function in print-hncp.c" }, { "cve": "CVE-2018-16229", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760458" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read vulnerability was discovered in tcpdump while printing DCCP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in dccp_print_option() function in print-dccp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16229" }, { "category": "external", "summary": "RHBZ#1760458", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760458" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16229", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16229" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16229", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16229" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in dccp_print_option() function in print-dccp.c" }, { "cve": "CVE-2018-16230", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760516" } ], "notes": [ { "category": "description", "text": "The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in bgp_attr_print() function in print-bgp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16230" }, { "category": "external", "summary": "RHBZ#1760516", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760516" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16230", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16230" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16230", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16230" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in bgp_attr_print() function in print-bgp.c" }, { "cve": "CVE-2018-16300", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760445" } ], "notes": [ { "category": "description", "text": "An uncontrolled resource consumption flaw was discovered in the way tcpdump prints BGP packets. The BGP protocol allows ATTR_SET to be nested as many times as the message can accommodate, however when a specially crafted packet is crafted and parsed by tcpdump, this may lead to stack exhaustion due to uncontrolled recursion. System availability is the highest threat from this vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Resource exhaustion in bgp_attr_print() function in print-bgp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16300" }, { "category": "external", "summary": "RHBZ#1760445", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760445" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16300", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16300" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16300", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16300" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Resource exhaustion in bgp_attr_print() function in print-bgp.c" }, { "cve": "CVE-2018-16451", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760517" } ], "notes": [ { "category": "description", "text": "The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \\MAILSLOT\\BROWSE and \\PIPE\\LANMAN.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer over-read in print_trans() function in print-smb.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16451" }, { "category": "external", "summary": "RHBZ#1760517", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760517" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16451", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16451" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16451", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16451" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer over-read in print_trans() function in print-smb.c" }, { "cve": "CVE-2018-16452", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760518" } ], "notes": [ { "category": "description", "text": "The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Resource exhaustion in smb_fdata() funtion in smbutil.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16452" }, { "category": "external", "summary": "RHBZ#1760518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760518" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16452", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16452" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16452", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16452" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Resource exhaustion in smb_fdata() funtion in smbutil.c" }, { "cve": "CVE-2019-15166", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2019-09-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1760520" } ], "notes": [ { "category": "description", "text": "lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.", "title": "Vulnerability description" }, { "category": "summary", "text": "tcpdump: Buffer overflow in lmp_print_data_link_subobjs() in print-lmp.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-15166" }, { "category": "external", "summary": "RHBZ#1760520", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1760520" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-15166", "url": "https://www.cve.org/CVERecord?id=CVE-2019-15166" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-15166", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15166" } ], "release_date": "2019-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:47:16+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4760" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.src", "AppStream-8.3.0.GA:tcpdump-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debuginfo-14:4.9.3-1.el8.x86_64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.aarch64", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.ppc64le", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.s390x", "AppStream-8.3.0.GA:tcpdump-debugsource-14:4.9.3-1.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tcpdump: Buffer overflow in lmp_print_data_link_subobjs() in print-lmp.c" } ] }
var-201910-1495
Vulnerability from variot
The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print(). tcpdump Contains an out-of-bounds vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. tcpdump is a set of sniffing tools run under the command line by the Tcpdump team. Description:
Red Hat OpenShift Container Storage is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Container Storage is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Container Storage provisions a multicloud data management service with an S3 compatible API.
These updated images include numerous security fixes, bug fixes, and enhancements.
Security Fix(es):
-
nodejs-node-forge: prototype pollution via the util.setPath function (CVE-2020-7720)
-
nodejs-json-bigint: Prototype pollution via
__proto__
assignment could result in DoS (CVE-2020-8237) -
golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)
-
golang: data race in certain net/http servers including ReverseProxy can lead to DoS (CVE-2020-15586)
-
golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs (CVE-2020-16845)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):
1806266 - Require an extension to the cephfs subvolume commands, that can return metadata regarding a subvolume
1813506 - Dockerfile not compatible with docker and buildah
1817438 - OSDs not distributed uniformly across OCS nodes on a 9-node AWS IPI setup
1817850 - [BAREMETAL] rook-ceph-operator does not reconcile when osd deployment is deleted when performed node replacement
1827157 - OSD hitting default CPU limit on AWS i3en.2xlarge instances limiting performance
1829055 - [RFE] add insecureEdgeTerminationPolicy: Redirect to noobaa mgmt route (http to https)
1833153 - add a variable for sleep time of rook operator between checks of downed OSD+Node.
1836299 - NooBaa Operator deploys with HPA that fires maxreplicas alerts by default
1842254 - [NooBaa] Compression stats do not add up when compression id disabled
1845976 - OCS 4.5 Independent mode: must-gather commands fails to collect ceph command outputs from external cluster
1849771 - [RFE] Account created by OBC should have same permissions as bucket owner
1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash
1854500 - [tracker-rhcs bug 1838931] mgr/volumes: add command to return metadata of a subvolume snapshot
1854501 - [Tracker-rhcs bug 1848494 ]pybind/mgr/volumes: Add the ability to keep snapshots of subvolumes independent of the source subvolume
1854503 - [tracker-rhcs-bug 1848503] cephfs: Provide alternatives to increase the total cephfs subvolume snapshot counts to greater than the current 400 across a Cephfs volume
1856953 - CVE-2020-15586 golang: data race in certain net/http servers including ReverseProxy can lead to DoS
1858195 - [GSS] registry pod stuck in ContainerCreating due to pvc from cephfs storage class fail to mount
1859183 - PV expansion is failing in retry loop in pre-existing PV after upgrade to OCS 4.5 (i.e. if the PV spec does not contain expansion params)
1859229 - Rook should delete extra MON PVCs in case first reconcile takes too long and rook skips "b" and "c" (spawned from Bug 1840084#c14)
1859478 - OCS 4.6 : Upon deployment, CSI Pods in CLBO with error - flag provided but not defined: -metadatastorage
1860022 - OCS 4.6 Deployment: LBP CSV and pod should not be deployed since ob/obc CRDs are owned from OCS 4.5 onwards
1860034 - OCS 4.6 Deployment in ocs-ci : Toolbox pod in ContainerCreationError due to key admin-secret not found
1860670 - OCS 4.5 Uninstall External: Openshift-storage namespace in Terminating state as CephObjectStoreUser had finalizers remaining
1860848 - Add validation for rgw-pool-prefix in the ceph-external-cluster-details-exporter script
1861780 - [Tracker BZ1866386][IBM s390x] Mount Failed for CEPH while running couple of OCS test cases.
1865938 - CSIDrivers missing in OCS 4.6
1867024 - [ocs-operator] operator v4.6.0-519.ci is in Installing state
1867099 - CVE-2020-16845 golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs
1868060 - [External Cluster] Noobaa-default-backingstore PV in released state upon OCS 4.5 uninstall (Secret not found)
1868703 - [rbd] After volume expansion, the new size is not reflected on the pod
1869411 - capture full crash information from ceph
1870061 - [RHEL][IBM] OCS un-install should make the devices raw
1870338 - OCS 4.6 must-gather : ocs-must-gather-xxx-helper pod in ContainerCreationError (couldn't find key admin-secret)
1870631 - OCS 4.6 Deployment : RGW pods went into 'CrashLoopBackOff' state on Z Platform
1872119 - Updates don't work on StorageClass which will keep PV expansion disabled for upgraded cluster
1872696 - [ROKS][RFE]NooBaa Configure IBM COS as default backing store
1873864 - Noobaa: On an baremetal RHCOS cluster, some backingstores are stuck in PROGRESSING state with INVALID_ENDPOINT TemporaryError
1874606 - CVE-2020-7720 nodejs-node-forge: prototype pollution via the util.setPath function
1875476 - Change noobaa logo in the noobaa UI
1877339 - Incorrect use of logr
1877371 - NooBaa UI warning message on Deploy Kubernetes Pool process - typo and shown number is incorrect
1878153 - OCS 4.6 must-gather: collect node information under cluster_scoped_resources/oc_output directory
1878714 - [FIPS enabled] BadDigest error on file upload to noobaa bucket
1878853 - [External Mode] ceph-external-cluster-details-exporter.py does not tolerate TLS enabled RGW
1879008 - ocs-osd-removal job fails because it can't find admin-secret in rook-ceph-mon secret
1879072 - Deployment with encryption at rest is failing to bring up OSD pods
1879919 - [External] Upgrade mechanism from OCS 4.5 to OCS 4.6 needs to be fixed
1880255 - Collect rbd info and subvolume info and snapshot info command output
1881028 - CVE-2020-8237 nodejs-json-bigint: Prototype pollution via __proto__
assignment could result in DoS
1881071 - [External] Upgrade mechanism from OCS 4.5 to OCS 4.6 needs to be fixed
1882397 - MCG decompression problem with snappy on s390x arch
1883253 - CSV doesn't contain values required for UI to enable minimal deployment and cluster encryption
1883398 - Update csi sidecar containers in rook
1883767 - Using placement strategies in cluster-service.yaml causes ocs-operator to crash
1883810 - [External mode] RGW metrics is not available after OCS upgrade from 4.5 to 4.6
1883927 - Deployment with encryption at rest is failing to bring up OSD pods
1885175 - Handle disappeared underlying device for encrypted OSD
1885428 - panic seen in rook-ceph during uninstall - "close of closed channel"
1885648 - [Tracker for https://bugzilla.redhat.com/show_bug.cgi?id=1885700] FSTYPE for localvolumeset devices shows up as ext2 after uninstall
1885971 - ocs-storagecluster-cephobjectstore doesn't report true state of RGW
1886308 - Default VolumeSnapshot Classes not created in External Mode
1886348 - osd removal job failed with status "Error"
1886551 - Clone creation failed after timeout of 5 hours of Azure platrom for 3 CephFS PVCs ( PVC sizes: 1, 25 and 100 GB)
1886709 - [External] RGW storageclass disappears after upgrade from OCS 4.5 to 4.6
1886859 - OCS 4.6: Uninstall stuck indefinitely if any Ceph pods are in Pending state before uninstall
1886873 - [OCS 4.6 External/Internal Uninstall] - Storage Cluster deletion stuck indefinitely, "failed to delete object store", remaining users: [noobaa-ceph-objectstore-user]
1888583 - [External] When deployment is attempted without specifying the monitoring-endpoint while generating JSON, the CSV is stuck in installing state
1888593 - [External] Add validation for monitoring-endpoint and port in the exporter script
1888614 - [External] Unreachable monitoring-endpoint used during deployment causes ocs-operator to crash
1889441 - Traceback error message while running OCS 4.6 must-gather
1889683 - [GSS] Noobaa Problem when setting public access to a bucket
1889866 - Post node power off/on, an unused MON PVC still stays back in the cluster
1890183 - [External] ocs-operator logs are filled with "failed to reconcile metrics exporter"
1890638 - must-gather helper pod should be deleted after collecting ceph crash info
1890971 - [External] RGW metrics are not available if anything else except 9283 is provided as the monitoring-endpoint-port
1891856 - ocs-metrics-exporter pod should have tolerations for OCS taint
1892206 - [GSS] Ceph image/version mismatch
1892234 - clone #95 creation failed for CephFS PVC ( 10 GB PVC size) during multiple clones creation test
1893624 - Must Gather is not collecting the tar file from NooBaa diagnose
1893691 - OCS4.6 must_gather failes to complete in 600sec
1893714 - Bad response for upload an object with encryption
1895402 - Mon pods didn't get upgraded in 720 second timeout from OCS 4.5 upgrade to 4.6
1896298 - [RFE] Monitoring for Namespace buckets and resources
1896831 - Clone#452 for RBD PVC ( PVC size 1 GB) failed to be created for 600 secs
1898521 - [CephFS] Deleting cephfsplugin pod along with app pods will make PV remain in Released state after deleting the PVC
1902627 - must-gather should wait for debug pods to be in ready state
1904171 - RGW Service is unavailable for a short period during upgrade to OCS 4.6
Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/libpcap-1.9.1-i586-1_slack14.2.txz: Upgraded. patches/packages/tcpdump-4.9.3-i586-1_slack14.2.txz: Upgraded. Fix buffer overflow/overread vulnerabilities and command line argument/local issues. For more information, see: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14468 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14469 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14470 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14466 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14461 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14462 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14465 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14881 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14464 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14463 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14467 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10103 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10105 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14880 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16451 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14882 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16227 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16229 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16301 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16230 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16452 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16300 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16228 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15166 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15167 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14879 ( Security fix ) +--------------------------+
Where to find the new packages: +-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you.
Updated packages for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/libpcap-1.9.1-i486-1_slack14.0.txz ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/tcpdump-4.9.3-i486-1_slack14.0.txz
Updated packages for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/libpcap-1.9.1-x86_64-1_slack14.0.txz ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/tcpdump-4.9.3-x86_64-1_slack14.0.txz
Updated packages for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/libpcap-1.9.1-i486-1_slack14.1.txz ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/tcpdump-4.9.3-i486-1_slack14.1.txz
Updated packages for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/libpcap-1.9.1-x86_64-1_slack14.1.txz ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/tcpdump-4.9.3-x86_64-1_slack14.1.txz
Updated packages for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/libpcap-1.9.1-i586-1_slack14.2.txz ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/tcpdump-4.9.3-i586-1_slack14.2.txz
Updated packages for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/libpcap-1.9.1-x86_64-1_slack14.2.txz ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/tcpdump-4.9.3-x86_64-1_slack14.2.txz
Updated packages for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/libpcap-1.9.0-i586-1.txz ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/tcpdump-4.9.2-i586-3.txz
Updated packages for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/libpcap-1.9.1-x86_64-1.txz ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/tcpdump-4.9.3-x86_64-1.txz
MD5 signatures: +-------------+
Slackware 14.0 packages: 0855bcc24c0d39f6ec3c6fa7d956ebf4 libpcap-1.9.1-i486-1_slack14.0.txz 1c53d8ea7923c5947dbbf0eb2dfca2aa tcpdump-4.9.3-i486-1_slack14.0.txz
Slackware x86_64 14.0 packages: 080435560c6498ba82e3131d9d7f36e4 libpcap-1.9.1-x86_64-1_slack14.0.txz 3740823881e104943cb15be6870a0e7d tcpdump-4.9.3-x86_64-1_slack14.0.txz
Slackware 14.1 packages: 7f1dffd77993897a3729c1fb3ea5e395 libpcap-1.9.1-i486-1_slack14.1.txz b267563e154bbddab251e8e2c7a11f69 tcpdump-4.9.3-i486-1_slack14.1.txz
Slackware x86_64 14.1 packages: 1177a6f007a4924c2116d15f8cb92900 libpcap-1.9.1-x86_64-1_slack14.1.txz de9844ab61993927903a91fc05450c8c tcpdump-4.9.3-x86_64-1_slack14.1.txz
Slackware 14.2 packages: 2672c9a84590170ff8f7f2b233af9a38 libpcap-1.9.1-i586-1_slack14.2.txz 578dbf94aa192915243e2d200c557cc5 tcpdump-4.9.3-i586-1_slack14.2.txz
Slackware x86_64 14.2 packages: 16f70962eebe606d3d9668202752bc51 libpcap-1.9.1-x86_64-1_slack14.2.txz 0a4b8400d30a84bc1df774b3537cb4b5 tcpdump-4.9.3-x86_64-1_slack14.2.txz
Slackware -current packages: 8765839c82fc67a8075b9e1c5211776b l/libpcap-1.9.0-i586-1.txz 9de3c38d7c061534d28b5b599ab5d563 n/tcpdump-4.9.2-i586-3.txz
Slackware x86_64 -current packages: cb278799afec0d6e99ce9a126b9e65f3 l/libpcap-1.9.1-x86_64-1.txz 2d14083ccadb447e5af06e0f940fefa5 n/tcpdump-4.9.3-x86_64-1.txz
Installation instructions: +------------------------+
Upgrade the packages as root:
upgradepkg libpcap-1.9.1-i586-1_slack14.2.txz tcpdump-4.9.3-i586-1_slack14.2.txz
+-----+
Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com
+------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. ========================================================================== Ubuntu Security Notice USN-4252-1 January 27, 2020
tcpdump vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in tcpdump.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04 LTS: tcpdump 4.9.3-0ubuntu0.18.04.1
Ubuntu 16.04 LTS: tcpdump 4.9.3-0ubuntu0.16.04.1
This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes. These vulnerabilities might result in denial of service or, potentially, execution of arbitrary code.
For the oldstable distribution (stretch), these problems have been fixed in version 4.9.3-1~deb9u1.
For the stable distribution (buster), these problems have been fixed in version 4.9.3-1~deb10u1. Bugs fixed (https://bugzilla.redhat.com/):
1732329 - Virtual Machine is missing documentation of its properties in yaml editor
1783192 - Guest kernel panic when start RHEL6.10 guest with q35 machine type and virtio disk in cnv
1791753 - [RFE] [SSP] Template validator should check validations in template's parent template
1804533 - CVE-2020-9283 golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic
1848954 - KMP missing CA extensions in cabundle of mutatingwebhookconfiguration
1848956 - KMP requires downtime for CA stabilization during certificate rotation
1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash
1853911 - VM with dot in network name fails to start with unclear message
1854098 - NodeNetworkState on workers doesn't have "status" key due to nmstate-handler pod failure to run "nmstatectl show"
1856347 - SR-IOV : Missing network name for sriov during vm setup
1856953 - CVE-2020-15586 golang: data race in certain net/http servers including ReverseProxy can lead to DoS
1859235 - Common Templates - after upgrade there are 2 common templates per each os-workload-flavor combination
1860714 - No API information from oc explain
1860992 - CNV upgrade - users are not removed from privileged SecurityContextConstraints
1864577 - [v2v][RHV to CNV non migratable source VM fails to import to Ceph-rbd / File system due to overhead required for Filesystem
1866593 - CDI is not handling vm disk clone
1867099 - CVE-2020-16845 golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs
1868817 - Container-native Virtualization 2.6.0 Images
1873771 - Improve the VMCreationFailed error message caused by VM low memory
1874812 - SR-IOV: Guest Agent expose link-local ipv6 address for sometime and then remove it
1878499 - DV import doesn't recover from scratch space PVC deletion
1879108 - Inconsistent naming of "oc virt" command in help text
1881874 - openshift-cnv namespace is getting stuck if the user tries to delete it while CNV is running
1883232 - Webscale: kubevirt/CNV datavolume importer pod inability to disable sidecar injection if namespace has sidecar injection enabled but VM Template does NOT
1883371 - CVE-2020-26160 jwt-go: access restriction bypass vulnerability
1885153 - [v2v][RHV to CNv VM import] Wrong Network mapping do not show a relevant error message
1885418 - [openshift-cnv] issues with memory overhead calculation when limits are used
1887398 - [openshift-cnv][CNV] nodes need to exist and be labeled first, before the NodeNetworkConfigurationPolicy is applied
1889295 - [v2v][VMware to CNV VM import API] diskMappings: volumeMode Block is not passed on to PVC request.
1891285 - Common templates and kubevirt-config cm - update machine-type
1891440 - [v2v][VMware to CNV VM import API]Source VM with no network interface fail with unclear error
1892227 - [SSP] cluster scoped resources are not being reconciled
1893278 - openshift-virtualization-os-images namespace not seen by user
1893646 - [HCO] Pod placement configuration - dry run is not performed for all the configuration stanza
1894428 - Message for VMI not migratable is not clear enough
1894824 - [v2v][VM import] Pick the smallest template for the imported VM, and not always Medium
1894897 - [v2v][VMIO] VMimport CR is not reported as failed when target VM is deleted during the import
1895414 - Virt-operator is accepting updates to the placement of its workload components even with running VMs
1897635 - CVE-2020-28362 golang: math/big: panic during recursive division of very large numbers
1898072 - Add Fedora33 to Fedora common templates
1898840 - [v2v] VM import VMWare to CNV Import 63 chars vm name should not fail
1899558 - CNV 2.6 - nmstate fails to set state
1901480 - VM disk io can't worked if namespace have label kubemacpool
1902046 - Not possible to edit CDIConfig (through CDI CR / CDIConfig)
1902111 - CVE-2020-27813 golang-github-gorilla-websocket: integer overflow leads to denial of service
1903014 - hco-webhook pod in CreateContainerError
1903585 - [v2v] Windows 2012 VM imported from RHV goes into Windows repair mode
1904797 - [VMIO][vmware] A migrated RHEL/Windows VM starts in emergency mode/safe mode when target storage is NFS and target namespace is NOT "default"
1906199 - [CNV-2.5] CNV Tries to Install on Windows Workers
1907151 - kubevirt version is not reported correctly via virtctl
1907352 - VM/VMI link changes to kubevirt.io~v1~VirtualMachineInstance
on CNV 2.6
1907691 - [CNV] Configuring NodeNetworkConfigurationPolicy caused "Internal error occurred" for creating datavolume
1907988 - VM loses dynamic IP address of its default interface after migration
1908363 - Applying NodeNetworkConfigurationPolicy for different NIC than default disables br-ex bridge and nodes lose connectivity
1908421 - [v2v] [VM import RHV to CNV] Windows imported VM boot failed: INACCESSIBLE BOOT DEVICE error
1908883 - CVE-2020-29652 golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference
1909458 - [V2V][VMware to CNV VM import via api using VMIO] VM import to Ceph RBD/BLOCK fails on "qemu-img: /data/disk.img" error
1910857 - Provide a mechanism to enable the HotplugVolumes feature gate via HCO
1911118 - Windows VMI LiveMigration / shutdown fails on 'XML error: non unique alias detected: ua-')
1911396 - Set networkInterfaceMultiqueue false in rhel 6 template for e1000e interface
1911662 - el6 guests don't work properly if virtio bus is specified on various devices
1912908 - Allow using "scsi" bus for disks in template validation
1913248 - Creating vlan interface on top of a bond device via NodeNetworkConfigurationPolicy fails
1913320 - Informative message needed with virtctl image-upload, that additional step is needed from the user
1913717 - Users should have read permitions for golden images data volumes
1913756 - Migrating to Ceph-RBD + Block fails when skipping zeroes
1914177 - CNV does not preallocate blank file data volumes
1914608 - Obsolete CPU models (kubevirt-cpu-plugin-configmap) are set on worker nodes
1914947 - HPP golden images - DV shoudld not be created with WaitForFirstConsumer
1917908 - [VMIO] vmimport pod fail to create when using ceph-rbd/block
1917963 - [CNV 2.6] Unable to install CNV disconnected - requires kvm-info-nfd-plugin which is not mirrored
1919391 - CVE-2021-20206 containernetworking-cni: Arbitrary path injection via type field in CNI configuration
1920576 - HCO can report ready=true when it failed to create a CR for a component operator
1920610 - e2e-aws-4.7-cnv consistently failing on Hyperconverged Cluster Operator
1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation
1923979 - kubernetes-nmstate: nmstate-handler pod crashes when configuring bridge device using ip tool
1927373 - NoExecute taint violates pdb; VMIs are not live migrated
1931376 - VMs disconnected from nmstate-defined bridge after CNV-2.5.4->CNV-2.6.0 upgrade
- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra
macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra is now available and addresses the following:
ATS Available for: macOS Catalina 10.15 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2019-8837: Csaba Fitzl (@theevilbit)
Bluetooth Available for: macOS Catalina 10.15 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2019-8853: Jianjun Dai of Qihoo 360 Alpha Lab
CallKit Available for: macOS Catalina 10.15 Impact: Calls made using Siri may be initiated using the wrong cellular plan on devices with two active plans Description: An API issue existed in the handling of outgoing phone calls initiated with Siri. This issue was addressed with improved state handling. CVE-2019-8856: Fabrice TERRANCLE of TERRANCLE SARL
CFNetwork Proxies Available for: macOS Catalina 10.15 Impact: An application may be able to gain elevated privileges Description: This issue was addressed with improved checks. CVE-2019-8848: Zhuo Liang of Qihoo 360 Vulcan Team
CUPS Available for: macOS Catalina 10.15 Impact: In certain configurations, a remote attacker may be able to submit arbitrary print jobs Description: A buffer overflow was addressed with improved bounds checking. CVE-2019-8842: Niky1235 of China Mobile
CUPS Available for: macOS Catalina 10.15 Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A buffer overflow was addressed with improved bounds checking. CVE-2019-8839: Stephan Zeisberg of Security Research Labs
FaceTime Available for: macOS Catalina 10.15 Impact: Processing malicious video via FaceTime may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8830: Natalie Silvanovich of Google Project Zero
Kernel Available for: macOS Catalina 10.15 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed by removing the vulnerable code. CVE-2019-8833: Ian Beer of Google Project Zero
Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2019-8828: Cim Stordal of Cognite CVE-2019-8838: Dr Silvio Cesare of InfoSect CVE-2019-8847: Apple CVE-2019-8852: pattern-f (@pattern_F_) of WaCai
libexpat Available for: macOS Catalina 10.15 Impact: Parsing a maliciously crafted XML file may lead to disclosure of user information Description: This issue was addressed by updating to expat version 2.2.8. CVE-2019-15903: Joonun Jang
OpenLDAP Available for: macOS Catalina 10.15 Impact: Multiple issues in OpenLDAP Description: Multiple issues were addressed by updating to OpenLDAP version 2.4.28. CVE-2012-1164 CVE-2012-2668 CVE-2013-4449 CVE-2015-1545 CVE-2019-13057 CVE-2019-13565
Security Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS Catalina 10.15 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2019-8832: Insu Yun of SSLab at Georgia Tech
tcpdump Available for: macOS Catalina 10.15 Impact: Multiple issues in tcpdump Description: Multiple issues were addressed by updating to tcpdump version 4.9.3 and libpcap version 1.9.1 CVE-2017-16808 CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462 CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466 CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470 CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882 CVE-2018-16227 CVE-2018-16228 CVE-2018-16229 CVE-2018-16230 CVE-2018-16300 CVE-2018-16301 CVE-2018-16451 CVE-2018-16452 CVE-2019-15161 CVE-2019-15162 CVE-2019-15163 CVE-2019-15164 CVE-2019-15165 CVE-2019-15166 CVE-2019-15167
Additional recognition
Accounts We would like to acknowledge Kishan Bagaria (KishanBagaria.com) and Tom Snelling of Loughborough University for their assistance.
Core Data We would like to acknowledge Natalie Silvanovich of Google Project Zero for their assistance.
Installation note:
macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl3wFrcACgkQBz4uGe3y 0M2TvQ/+P5SX/Aky5E6q7Izgy1qXX9KueeMzJr1bXIlNziKYzq4FajQ55cP42pwy FrADnXX3AOhvZtJXBfgpO7/QUHupICuUbW5WQMQFiSTZFFwmHugrKvjIQqeFk5gS NFlVpQ8CEmUpzidZx9XKxRMjWWRTbT8RjrrK1BcK9SdF1OHPS7+whQuxpUBunw/o 2OSPDPa0kFfkX6cWfTG/n/WU03UY0pAgvbydURICNnsiqyhXK9T4rdqhl5O9UlJJ OFuvyCAmqVI7RhcDKqFWdrSDap3fko7a/b7L3piqLkx2LrM9uVK9ll7Gf4BNd9h0 Jg5YbXx0ROZq+3uqky5zqx5bPoi8NpaQuld6xFCuOOLIcSJ/ywaV1EJzQaTJTZrB r6telp0NblBZldmMuy1Oty7tUOkTrr48j2YEKbLo7+SOcWI2tR8E8DVhUdvB+7Bc XIgN+tmj/3AZaOB7Tm6aTX6P82MucBCbenYB+1/JB8271XdBRpIHzEO6jDwnwwXd rkNq2xzE3TXTFwKx/nfjwK28/Jd8VgxrJTWfCKDzAOCqOidBHbkmitoQJQziCaUt j3cOERx+6xFAD5C9wddf3dcruIHtTP3B3CgK2gsTm8ZmsNCEaZPpzB1lW2k6/d9x 9sGVqZpDKh7YuBAxI00KukwRK+vTxtw5ImbzAMA95OzUu+eMB7A=3s8r -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: tcpdump security, bug fix, and enhancement update Advisory ID: RHSA-2020:4760-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4760 Issue date: 2020-11-03 CVE Names: CVE-2018-10103 CVE-2018-10105 CVE-2018-14461 CVE-2018-14462 CVE-2018-14463 CVE-2018-14464 CVE-2018-14465 CVE-2018-14466 CVE-2018-14467 CVE-2018-14468 CVE-2018-14469 CVE-2018-14470 CVE-2018-14879 CVE-2018-14880 CVE-2018-14881 CVE-2018-14882 CVE-2018-16227 CVE-2018-16228 CVE-2018-16229 CVE-2018-16230 CVE-2018-16300 CVE-2018-16451 CVE-2018-16452 CVE-2019-15166 ==================================================================== 1. Summary:
An update for tcpdump is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
- Description:
The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces.
The following packages have been upgraded to a later upstream version: tcpdump (4.9.3).
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source: tcpdump-4.9.3-1.el8.src.rpm
aarch64: tcpdump-4.9.3-1.el8.aarch64.rpm tcpdump-debuginfo-4.9.3-1.el8.aarch64.rpm tcpdump-debugsource-4.9.3-1.el8.aarch64.rpm
ppc64le: tcpdump-4.9.3-1.el8.ppc64le.rpm tcpdump-debuginfo-4.9.3-1.el8.ppc64le.rpm tcpdump-debugsource-4.9.3-1.el8.ppc64le.rpm
s390x: tcpdump-4.9.3-1.el8.s390x.rpm tcpdump-debuginfo-4.9.3-1.el8.s390x.rpm tcpdump-debugsource-4.9.3-1.el8.s390x.rpm
x86_64: tcpdump-4.9.3-1.el8.x86_64.rpm tcpdump-debuginfo-4.9.3-1.el8.x86_64.rpm tcpdump-debugsource-4.9.3-1.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2018-10103 https://access.redhat.com/security/cve/CVE-2018-10105 https://access.redhat.com/security/cve/CVE-2018-14461 https://access.redhat.com/security/cve/CVE-2018-14462 https://access.redhat.com/security/cve/CVE-2018-14463 https://access.redhat.com/security/cve/CVE-2018-14464 https://access.redhat.com/security/cve/CVE-2018-14465 https://access.redhat.com/security/cve/CVE-2018-14466 https://access.redhat.com/security/cve/CVE-2018-14467 https://access.redhat.com/security/cve/CVE-2018-14468 https://access.redhat.com/security/cve/CVE-2018-14469 https://access.redhat.com/security/cve/CVE-2018-14470 https://access.redhat.com/security/cve/CVE-2018-14879 https://access.redhat.com/security/cve/CVE-2018-14880 https://access.redhat.com/security/cve/CVE-2018-14881 https://access.redhat.com/security/cve/CVE-2018-14882 https://access.redhat.com/security/cve/CVE-2018-16227 https://access.redhat.com/security/cve/CVE-2018-16228 https://access.redhat.com/security/cve/CVE-2018-16229 https://access.redhat.com/security/cve/CVE-2018-16230 https://access.redhat.com/security/cve/CVE-2018-16300 https://access.redhat.com/security/cve/CVE-2018-16451 https://access.redhat.com/security/cve/CVE-2018-16452 https://access.redhat.com/security/cve/CVE-2019-15166 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBX6I4ENzjgjWX9erEAQhWpBAAl8gza241WtZUglkRZgl5MEblBH2i/YD7 ixrj7P/T6FmlkhbgotT6cWAD4v/oej0aV3VlgnlY9JI9iPGKvP6ZYu8jbaW50Lr+ E1wDuI/6nAp/e6DLSYAe1qD52c06SrPdlMP40SE9ZQoTDe38Z8Uvfpm7X4CN9wgi AbGc3fUHkO5EDrYDpiT3UxF3X71yVq8/mWJRNo2T8IPxc6ufGJM524cFLV6KDx1q h0vDHxcv69wCwKXjYHBoU/X5Bq7k4KuTTbI4B5NgHouWrosUYcn5Bo9eiSfjY0C3 cGD+CSQ/cBHzOleg7X6f3vrI7p6Gc0RG/npAIx7VfUucg8GYmdS2cjv93A5oqXJQ VIOGjtdX9dV6WEY2kkfJmjHJr4ehef6n6LML9U0F3OIMHYAeM9xObQYVU/iYH1db 1kHQmLcQNR5RbNAm9VKuZdEU/V/IdM0bb1gGZEiuAbu1esSwV9h9zbke4Nf3pmC1 qCmHF6sDyBrrHv1J0sr7dsd4gIlrNhXxtej+3FHCnKiuyMIyrPaKmsjidSeNyHTQ oQVAxH4doUpiWeViH0/wEg7tcRuU6AFW64iFnMzXG2/iP4H5Oin9Gzsky+cdU+RH GfzzlTFeyNqhdxeoncnskYCKWN+rKCM+7kPVoSa2JwbZDgWFAIlFNkHsYSjBnYDD 5ua+Acdmj44=1sro -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201910-1495", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "30" }, { "model": "traffix signaling delivery controller", "scope": "lte", "trust": 1.0, "vendor": "f5", "version": "5.1.0" }, { "model": "tcpdump", "scope": "lt", "trust": 1.0, "vendor": "tcpdump", "version": "4.9.3" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "31" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "10.0" }, { "model": "enterprise linux", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "8.0" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "8.0" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "29" }, { "model": "mac os x", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "10.15.2" }, { "model": "leap", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": "15.1" }, { "model": "enterprise linux", "scope": "eq", "trust": 1.0, "vendor": "redhat", "version": "7.0" }, { "model": "traffix signaling delivery controller", "scope": "gte", "trust": 1.0, "vendor": "f5", "version": "5.0.0" }, { "model": "leap", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": "15.0" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "9.0" }, { "model": "tcpdump", "scope": "lt", "trust": 0.8, "vendor": "the tcpdump group", "version": "4.9.3" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "db": "NVD", "id": "CVE-2018-14462" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:tcpdump:tcpdump", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-016104" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Ubuntu,Red Hat,Slackware Security Team", "sources": [ { "db": "CNNVD", "id": "CNNVD-201910-106" } ], "trust": 0.6 }, "cve": "CVE-2018-14462", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "CVE-2018-14462", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 1.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Partial", "baseScore": 7.5, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "CVE-2018-14462", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "VHN-124624", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "id": "CVE-2018-14462", "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 9.8, "baseSeverity": "Critical", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2018-14462", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2018-14462", "trust": 1.0, "value": "HIGH" }, { "author": "NVD", "id": "CVE-2018-14462", "trust": 0.8, "value": "Critical" }, { "author": "CNNVD", "id": "CNNVD-201910-106", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-124624", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-124624" }, { "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "db": "CNNVD", "id": "CNNVD-201910-106" }, { "db": "NVD", "id": "CVE-2018-14462" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print(). tcpdump Contains an out-of-bounds vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. tcpdump is a set of sniffing tools run under the command line by the Tcpdump team. Description:\n\nRed Hat OpenShift Container Storage is software-defined storage integrated\nwith and optimized for the Red Hat OpenShift Container Platform. Red Hat\nOpenShift Container Storage is a highly scalable, production-grade\npersistent storage for stateful applications running in the Red Hat\nOpenShift Container Platform. In addition to persistent storage, Red Hat\nOpenShift Container Storage provisions a multicloud data management service\nwith an S3 compatible API. \n\nThese updated images include numerous security fixes, bug fixes, and\nenhancements. \n\nSecurity Fix(es):\n\n* nodejs-node-forge: prototype pollution via the util.setPath function\n(CVE-2020-7720)\n\n* nodejs-json-bigint: Prototype pollution via `__proto__` assignment could\nresult in DoS (CVE-2020-8237)\n\n* golang.org/x/text: possibility to trigger an infinite loop in\nencoding/unicode could lead to crash (CVE-2020-14040)\n\n* golang: data race in certain net/http servers including ReverseProxy can\nlead to DoS (CVE-2020-15586)\n\n* golang: ReadUvarint and ReadVarint can read an unlimited number of bytes\nfrom invalid inputs (CVE-2020-16845)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):\n\n1806266 - Require an extension to the cephfs subvolume commands, that can return metadata regarding a subvolume\n1813506 - Dockerfile not compatible with docker and buildah\n1817438 - OSDs not distributed uniformly across OCS nodes on a 9-node AWS IPI setup\n1817850 - [BAREMETAL] rook-ceph-operator does not reconcile when osd deployment is deleted when performed node replacement\n1827157 - OSD hitting default CPU limit on AWS i3en.2xlarge instances limiting performance\n1829055 - [RFE] add insecureEdgeTerminationPolicy: Redirect to noobaa mgmt route (http to https)\n1833153 - add a variable for sleep time of rook operator between checks of downed OSD+Node. \n1836299 - NooBaa Operator deploys with HPA that fires maxreplicas alerts by default\n1842254 - [NooBaa] Compression stats do not add up when compression id disabled\n1845976 - OCS 4.5 Independent mode: must-gather commands fails to collect ceph command outputs from external cluster\n1849771 - [RFE] Account created by OBC should have same permissions as bucket owner\n1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash\n1854500 - [tracker-rhcs bug 1838931] mgr/volumes: add command to return metadata of a subvolume snapshot\n1854501 - [Tracker-rhcs bug 1848494 ]pybind/mgr/volumes: Add the ability to keep snapshots of subvolumes independent of the source subvolume\n1854503 - [tracker-rhcs-bug 1848503] cephfs: Provide alternatives to increase the total cephfs subvolume snapshot counts to greater than the current 400 across a Cephfs volume\n1856953 - CVE-2020-15586 golang: data race in certain net/http servers including ReverseProxy can lead to DoS\n1858195 - [GSS] registry pod stuck in ContainerCreating due to pvc from cephfs storage class fail to mount\n1859183 - PV expansion is failing in retry loop in pre-existing PV after upgrade to OCS 4.5 (i.e. if the PV spec does not contain expansion params)\n1859229 - Rook should delete extra MON PVCs in case first reconcile takes too long and rook skips \"b\" and \"c\" (spawned from Bug 1840084#c14)\n1859478 - OCS 4.6 : Upon deployment, CSI Pods in CLBO with error - flag provided but not defined: -metadatastorage\n1860022 - OCS 4.6 Deployment: LBP CSV and pod should not be deployed since ob/obc CRDs are owned from OCS 4.5 onwards\n1860034 - OCS 4.6 Deployment in ocs-ci : Toolbox pod in ContainerCreationError due to key admin-secret not found\n1860670 - OCS 4.5 Uninstall External: Openshift-storage namespace in Terminating state as CephObjectStoreUser had finalizers remaining\n1860848 - Add validation for rgw-pool-prefix in the ceph-external-cluster-details-exporter script\n1861780 - [Tracker BZ1866386][IBM s390x] Mount Failed for CEPH while running couple of OCS test cases. \n1865938 - CSIDrivers missing in OCS 4.6\n1867024 - [ocs-operator] operator v4.6.0-519.ci is in Installing state\n1867099 - CVE-2020-16845 golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs\n1868060 - [External Cluster] Noobaa-default-backingstore PV in released state upon OCS 4.5 uninstall (Secret not found)\n1868703 - [rbd] After volume expansion, the new size is not reflected on the pod\n1869411 - capture full crash information from ceph\n1870061 - [RHEL][IBM] OCS un-install should make the devices raw\n1870338 - OCS 4.6 must-gather : ocs-must-gather-xxx-helper pod in ContainerCreationError (couldn\u0027t find key admin-secret)\n1870631 - OCS 4.6 Deployment : RGW pods went into \u0027CrashLoopBackOff\u0027 state on Z Platform\n1872119 - Updates don\u0027t work on StorageClass which will keep PV expansion disabled for upgraded cluster\n1872696 - [ROKS][RFE]NooBaa Configure IBM COS as default backing store\n1873864 - Noobaa: On an baremetal RHCOS cluster, some backingstores are stuck in PROGRESSING state with INVALID_ENDPOINT TemporaryError\n1874606 - CVE-2020-7720 nodejs-node-forge: prototype pollution via the util.setPath function\n1875476 - Change noobaa logo in the noobaa UI\n1877339 - Incorrect use of logr\n1877371 - NooBaa UI warning message on Deploy Kubernetes Pool process - typo and shown number is incorrect\n1878153 - OCS 4.6 must-gather: collect node information under cluster_scoped_resources/oc_output directory\n1878714 - [FIPS enabled] BadDigest error on file upload to noobaa bucket\n1878853 - [External Mode] ceph-external-cluster-details-exporter.py does not tolerate TLS enabled RGW\n1879008 - ocs-osd-removal job fails because it can\u0027t find admin-secret in rook-ceph-mon secret\n1879072 - Deployment with encryption at rest is failing to bring up OSD pods\n1879919 - [External] Upgrade mechanism from OCS 4.5 to OCS 4.6 needs to be fixed\n1880255 - Collect rbd info and subvolume info and snapshot info command output\n1881028 - CVE-2020-8237 nodejs-json-bigint: Prototype pollution via `__proto__` assignment could result in DoS\n1881071 - [External] Upgrade mechanism from OCS 4.5 to OCS 4.6 needs to be fixed\n1882397 - MCG decompression problem with snappy on s390x arch\n1883253 - CSV doesn\u0027t contain values required for UI to enable minimal deployment and cluster encryption\n1883398 - Update csi sidecar containers in rook\n1883767 - Using placement strategies in cluster-service.yaml causes ocs-operator to crash\n1883810 - [External mode] RGW metrics is not available after OCS upgrade from 4.5 to 4.6\n1883927 - Deployment with encryption at rest is failing to bring up OSD pods\n1885175 - Handle disappeared underlying device for encrypted OSD\n1885428 - panic seen in rook-ceph during uninstall - \"close of closed channel\"\n1885648 - [Tracker for https://bugzilla.redhat.com/show_bug.cgi?id=1885700] FSTYPE for localvolumeset devices shows up as ext2 after uninstall\n1885971 - ocs-storagecluster-cephobjectstore doesn\u0027t report true state of RGW\n1886308 - Default VolumeSnapshot Classes not created in External Mode\n1886348 - osd removal job failed with status \"Error\"\n1886551 - Clone creation failed after timeout of 5 hours of Azure platrom for 3 CephFS PVCs ( PVC sizes: 1, 25 and 100 GB)\n1886709 - [External] RGW storageclass disappears after upgrade from OCS 4.5 to 4.6\n1886859 - OCS 4.6: Uninstall stuck indefinitely if any Ceph pods are in Pending state before uninstall\n1886873 - [OCS 4.6 External/Internal Uninstall] - Storage Cluster deletion stuck indefinitely, \"failed to delete object store\", remaining users: [noobaa-ceph-objectstore-user]\n1888583 - [External] When deployment is attempted without specifying the monitoring-endpoint while generating JSON, the CSV is stuck in installing state\n1888593 - [External] Add validation for monitoring-endpoint and port in the exporter script\n1888614 - [External] Unreachable monitoring-endpoint used during deployment causes ocs-operator to crash\n1889441 - Traceback error message while running OCS 4.6 must-gather\n1889683 - [GSS] Noobaa Problem when setting public access to a bucket\n1889866 - Post node power off/on, an unused MON PVC still stays back in the cluster\n1890183 - [External] ocs-operator logs are filled with \"failed to reconcile metrics exporter\"\n1890638 - must-gather helper pod should be deleted after collecting ceph crash info\n1890971 - [External] RGW metrics are not available if anything else except 9283 is provided as the monitoring-endpoint-port\n1891856 - ocs-metrics-exporter pod should have tolerations for OCS taint\n1892206 - [GSS] Ceph image/version mismatch\n1892234 - clone #95 creation failed for CephFS PVC ( 10 GB PVC size) during multiple clones creation test\n1893624 - Must Gather is not collecting the tar file from NooBaa diagnose\n1893691 - OCS4.6 must_gather failes to complete in 600sec\n1893714 - Bad response for upload an object with encryption\n1895402 - Mon pods didn\u0027t get upgraded in 720 second timeout from OCS 4.5 upgrade to 4.6\n1896298 - [RFE] Monitoring for Namespace buckets and resources\n1896831 - Clone#452 for RBD PVC ( PVC size 1 GB) failed to be created for 600 secs\n1898521 - [CephFS] Deleting cephfsplugin pod along with app pods will make PV remain in Released state after deleting the PVC\n1902627 - must-gather should wait for debug pods to be in ready state\n1904171 - RGW Service is unavailable for a short period during upgrade to OCS 4.6\n\n5. \n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n+--------------------------+\npatches/packages/libpcap-1.9.1-i586-1_slack14.2.txz: Upgraded. \npatches/packages/tcpdump-4.9.3-i586-1_slack14.2.txz: Upgraded. \n Fix buffer overflow/overread vulnerabilities and command line\n argument/local issues. \n For more information, see:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16808\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14468\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14469\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14470\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14466\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14461\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14462\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14465\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14881\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14464\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14463\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14467\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10103\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10105\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14880\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16451\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14882\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16227\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16229\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16301\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16230\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16452\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16300\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16228\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15166\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15167\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14879\n (* Security fix *)\n+--------------------------+\n\n\nWhere to find the new packages:\n+-----------------------------+\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you. \n\nUpdated packages for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/libpcap-1.9.1-i486-1_slack14.0.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/tcpdump-4.9.3-i486-1_slack14.0.txz\n\nUpdated packages for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/libpcap-1.9.1-x86_64-1_slack14.0.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/tcpdump-4.9.3-x86_64-1_slack14.0.txz\n\nUpdated packages for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/libpcap-1.9.1-i486-1_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/tcpdump-4.9.3-i486-1_slack14.1.txz\n\nUpdated packages for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/libpcap-1.9.1-x86_64-1_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/tcpdump-4.9.3-x86_64-1_slack14.1.txz\n\nUpdated packages for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/libpcap-1.9.1-i586-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/tcpdump-4.9.3-i586-1_slack14.2.txz\n\nUpdated packages for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/libpcap-1.9.1-x86_64-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/tcpdump-4.9.3-x86_64-1_slack14.2.txz\n\nUpdated packages for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/libpcap-1.9.0-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/tcpdump-4.9.2-i586-3.txz\n\nUpdated packages for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/libpcap-1.9.1-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/tcpdump-4.9.3-x86_64-1.txz\n\n\nMD5 signatures:\n+-------------+\n\nSlackware 14.0 packages:\n0855bcc24c0d39f6ec3c6fa7d956ebf4 libpcap-1.9.1-i486-1_slack14.0.txz\n1c53d8ea7923c5947dbbf0eb2dfca2aa tcpdump-4.9.3-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 packages:\n080435560c6498ba82e3131d9d7f36e4 libpcap-1.9.1-x86_64-1_slack14.0.txz\n3740823881e104943cb15be6870a0e7d tcpdump-4.9.3-x86_64-1_slack14.0.txz\n\nSlackware 14.1 packages:\n7f1dffd77993897a3729c1fb3ea5e395 libpcap-1.9.1-i486-1_slack14.1.txz\nb267563e154bbddab251e8e2c7a11f69 tcpdump-4.9.3-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 packages:\n1177a6f007a4924c2116d15f8cb92900 libpcap-1.9.1-x86_64-1_slack14.1.txz\nde9844ab61993927903a91fc05450c8c tcpdump-4.9.3-x86_64-1_slack14.1.txz\n\nSlackware 14.2 packages:\n2672c9a84590170ff8f7f2b233af9a38 libpcap-1.9.1-i586-1_slack14.2.txz\n578dbf94aa192915243e2d200c557cc5 tcpdump-4.9.3-i586-1_slack14.2.txz\n\nSlackware x86_64 14.2 packages:\n16f70962eebe606d3d9668202752bc51 libpcap-1.9.1-x86_64-1_slack14.2.txz\n0a4b8400d30a84bc1df774b3537cb4b5 tcpdump-4.9.3-x86_64-1_slack14.2.txz\n\nSlackware -current packages:\n8765839c82fc67a8075b9e1c5211776b l/libpcap-1.9.0-i586-1.txz\n9de3c38d7c061534d28b5b599ab5d563 n/tcpdump-4.9.2-i586-3.txz\n\nSlackware x86_64 -current packages:\ncb278799afec0d6e99ce9a126b9e65f3 l/libpcap-1.9.1-x86_64-1.txz\n2d14083ccadb447e5af06e0f940fefa5 n/tcpdump-4.9.3-x86_64-1.txz\n\n\nInstallation instructions:\n+------------------------+\n\nUpgrade the packages as root:\n# upgradepkg libpcap-1.9.1-i586-1_slack14.2.txz tcpdump-4.9.3-i586-1_slack14.2.txz\n\n\n+-----+\n\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list: |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message: |\n| |\n| unsubscribe slackware-security |\n| |\n| You will get a confirmation message back containing instructions to |\n| complete the process. Please do not reply to this email address. ==========================================================================\nUbuntu Security Notice USN-4252-1\nJanuary 27, 2020\n\ntcpdump vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in tcpdump. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 18.04 LTS:\n tcpdump 4.9.3-0ubuntu0.18.04.1\n\nUbuntu 16.04 LTS:\n tcpdump 4.9.3-0ubuntu0.16.04.1\n\nThis update uses a new upstream release, which includes additional bug\nfixes. In general, a standard system update will make all the necessary\nchanges. These vulnerabilities might result in denial of\nservice or, potentially, execution of arbitrary code. \n\nFor the oldstable distribution (stretch), these problems have been fixed\nin version 4.9.3-1~deb9u1. \n\nFor the stable distribution (buster), these problems have been fixed in\nversion 4.9.3-1~deb10u1. Bugs fixed (https://bugzilla.redhat.com/):\n\n1732329 - Virtual Machine is missing documentation of its properties in yaml editor\n1783192 - Guest kernel panic when start RHEL6.10 guest with q35 machine type and virtio disk in cnv\n1791753 - [RFE] [SSP] Template validator should check validations in template\u0027s parent template\n1804533 - CVE-2020-9283 golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic\n1848954 - KMP missing CA extensions in cabundle of mutatingwebhookconfiguration\n1848956 - KMP requires downtime for CA stabilization during certificate rotation\n1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash\n1853911 - VM with dot in network name fails to start with unclear message\n1854098 - NodeNetworkState on workers doesn\u0027t have \"status\" key due to nmstate-handler pod failure to run \"nmstatectl show\"\n1856347 - SR-IOV : Missing network name for sriov during vm setup\n1856953 - CVE-2020-15586 golang: data race in certain net/http servers including ReverseProxy can lead to DoS\n1859235 - Common Templates - after upgrade there are 2 common templates per each os-workload-flavor combination\n1860714 - No API information from `oc explain`\n1860992 - CNV upgrade - users are not removed from privileged SecurityContextConstraints\n1864577 - [v2v][RHV to CNV non migratable source VM fails to import to Ceph-rbd / File system due to overhead required for Filesystem\n1866593 - CDI is not handling vm disk clone\n1867099 - CVE-2020-16845 golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs\n1868817 - Container-native Virtualization 2.6.0 Images\n1873771 - Improve the VMCreationFailed error message caused by VM low memory\n1874812 - SR-IOV: Guest Agent expose link-local ipv6 address for sometime and then remove it\n1878499 - DV import doesn\u0027t recover from scratch space PVC deletion\n1879108 - Inconsistent naming of \"oc virt\" command in help text\n1881874 - openshift-cnv namespace is getting stuck if the user tries to delete it while CNV is running\n1883232 - Webscale: kubevirt/CNV datavolume importer pod inability to disable sidecar injection if namespace has sidecar injection enabled but VM Template does NOT\n1883371 - CVE-2020-26160 jwt-go: access restriction bypass vulnerability\n1885153 - [v2v][RHV to CNv VM import] Wrong Network mapping do not show a relevant error message\n1885418 - [openshift-cnv] issues with memory overhead calculation when limits are used\n1887398 - [openshift-cnv][CNV] nodes need to exist and be labeled first, *before* the NodeNetworkConfigurationPolicy is applied\n1889295 - [v2v][VMware to CNV VM import API] diskMappings: volumeMode Block is not passed on to PVC request. \n1891285 - Common templates and kubevirt-config cm - update machine-type\n1891440 - [v2v][VMware to CNV VM import API]Source VM with no network interface fail with unclear error\n1892227 - [SSP] cluster scoped resources are not being reconciled\n1893278 - openshift-virtualization-os-images namespace not seen by user\n1893646 - [HCO] Pod placement configuration - dry run is not performed for all the configuration stanza\n1894428 - Message for VMI not migratable is not clear enough\n1894824 - [v2v][VM import] Pick the smallest template for the imported VM, and not always Medium\n1894897 - [v2v][VMIO] VMimport CR is not reported as failed when target VM is deleted during the import\n1895414 - Virt-operator is accepting updates to the placement of its workload components even with running VMs\n1897635 - CVE-2020-28362 golang: math/big: panic during recursive division of very large numbers\n1898072 - Add Fedora33 to Fedora common templates\n1898840 - [v2v] VM import VMWare to CNV Import 63 chars vm name should not fail\n1899558 - CNV 2.6 - nmstate fails to set state\n1901480 - VM disk io can\u0027t worked if namespace have label kubemacpool\n1902046 - Not possible to edit CDIConfig (through CDI CR / CDIConfig)\n1902111 - CVE-2020-27813 golang-github-gorilla-websocket: integer overflow leads to denial of service\n1903014 - hco-webhook pod in CreateContainerError\n1903585 - [v2v] Windows 2012 VM imported from RHV goes into Windows repair mode\n1904797 - [VMIO][vmware] A migrated RHEL/Windows VM starts in emergency mode/safe mode when target storage is NFS and target namespace is NOT \"default\"\n1906199 - [CNV-2.5] CNV Tries to Install on Windows Workers\n1907151 - kubevirt version is not reported correctly via virtctl\n1907352 - VM/VMI link changes to `kubevirt.io~v1~VirtualMachineInstance` on CNV 2.6\n1907691 - [CNV] Configuring NodeNetworkConfigurationPolicy caused \"Internal error occurred\" for creating datavolume\n1907988 - VM loses dynamic IP address of its default interface after migration\n1908363 - Applying NodeNetworkConfigurationPolicy for different NIC than default disables br-ex bridge and nodes lose connectivity\n1908421 - [v2v] [VM import RHV to CNV] Windows imported VM boot failed: INACCESSIBLE BOOT DEVICE error\n1908883 - CVE-2020-29652 golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference\n1909458 - [V2V][VMware to CNV VM import via api using VMIO] VM import to Ceph RBD/BLOCK fails on \"qemu-img: /data/disk.img\" error\n1910857 - Provide a mechanism to enable the HotplugVolumes feature gate via HCO\n1911118 - Windows VMI LiveMigration / shutdown fails on \u0027XML error: non unique alias detected: ua-\u0027)\n1911396 - Set networkInterfaceMultiqueue false in rhel 6 template for e1000e interface\n1911662 - el6 guests don\u0027t work properly if virtio bus is specified on various devices\n1912908 - Allow using \"scsi\" bus for disks in template validation\n1913248 - Creating vlan interface on top of a bond device via NodeNetworkConfigurationPolicy fails\n1913320 - Informative message needed with virtctl image-upload, that additional step is needed from the user\n1913717 - Users should have read permitions for golden images data volumes\n1913756 - Migrating to Ceph-RBD + Block fails when skipping zeroes\n1914177 - CNV does not preallocate blank file data volumes\n1914608 - Obsolete CPU models (kubevirt-cpu-plugin-configmap) are set on worker nodes\n1914947 - HPP golden images - DV shoudld not be created with WaitForFirstConsumer\n1917908 - [VMIO] vmimport pod fail to create when using ceph-rbd/block\n1917963 - [CNV 2.6] Unable to install CNV disconnected - requires kvm-info-nfd-plugin which is not mirrored\n1919391 - CVE-2021-20206 containernetworking-cni: Arbitrary path injection via type field in CNI configuration\n1920576 - HCO can report ready=true when it failed to create a CR for a component operator\n1920610 - e2e-aws-4.7-cnv consistently failing on Hyperconverged Cluster Operator\n1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation\n1923979 - kubernetes-nmstate: nmstate-handler pod crashes when configuring bridge device using ip tool\n1927373 - NoExecute taint violates pdb; VMIs are not live migrated\n1931376 - VMs disconnected from nmstate-defined bridge after CNV-2.5.4-\u003eCNV-2.6.0 upgrade\n\n5. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update\n2019-002 Mojave, Security Update 2019-007 High Sierra\n\nmacOS Catalina 10.15.2, Security Update 2019-002 Mojave,\nSecurity Update 2019-007 High Sierra is now available and\naddresses the following:\n\nATS\nAvailable for: macOS Catalina 10.15\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2019-8837: Csaba Fitzl (@theevilbit)\n\nBluetooth\nAvailable for: macOS Catalina 10.15\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2019-8853: Jianjun Dai of Qihoo 360 Alpha Lab\n\nCallKit\nAvailable for: macOS Catalina 10.15\nImpact: Calls made using Siri may be initiated using the wrong\ncellular plan on devices with two active plans\nDescription: An API issue existed in the handling of outgoing phone\ncalls initiated with Siri. This issue was addressed with improved\nstate handling. \nCVE-2019-8856: Fabrice TERRANCLE of TERRANCLE SARL\n\nCFNetwork Proxies\nAvailable for: macOS Catalina 10.15\nImpact: An application may be able to gain elevated privileges\nDescription: This issue was addressed with improved checks. \nCVE-2019-8848: Zhuo Liang of Qihoo 360 Vulcan Team\n\nCUPS\nAvailable for: macOS Catalina 10.15\nImpact: In certain configurations, a remote attacker may be able to\nsubmit arbitrary print jobs\nDescription: A buffer overflow was addressed with improved bounds\nchecking. \nCVE-2019-8842: Niky1235 of China Mobile\n\nCUPS\nAvailable for: macOS Catalina 10.15\nImpact: An attacker in a privileged position may be able to perform a\ndenial of service attack\nDescription: A buffer overflow was addressed with improved bounds\nchecking. \nCVE-2019-8839: Stephan Zeisberg of Security Research Labs\n\nFaceTime\nAvailable for: macOS Catalina 10.15\nImpact: Processing malicious video via FaceTime may lead to arbitrary\ncode execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8830: Natalie Silvanovich of Google Project Zero\n\nKernel\nAvailable for: macOS Catalina 10.15\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed by removing the\nvulnerable code. \nCVE-2019-8833: Ian Beer of Google Project Zero\n\nKernel\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2019-8828: Cim Stordal of Cognite\nCVE-2019-8838: Dr Silvio Cesare of InfoSect\nCVE-2019-8847: Apple\nCVE-2019-8852: pattern-f (@pattern_F_) of WaCai\n\nlibexpat\nAvailable for: macOS Catalina 10.15\nImpact: Parsing a maliciously crafted XML file may lead to disclosure\nof user information\nDescription: This issue was addressed by updating to expat version\n2.2.8. \nCVE-2019-15903: Joonun Jang\n\nOpenLDAP\nAvailable for: macOS Catalina 10.15\nImpact: Multiple issues in OpenLDAP\nDescription: Multiple issues were addressed by updating to OpenLDAP\nversion 2.4.28. \nCVE-2012-1164\nCVE-2012-2668\nCVE-2013-4449\nCVE-2015-1545\nCVE-2019-13057\nCVE-2019-13565\n\nSecurity\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6, macOS\nCatalina 10.15\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2019-8832: Insu Yun of SSLab at Georgia Tech\n\ntcpdump\nAvailable for: macOS Catalina 10.15\nImpact: Multiple issues in tcpdump\nDescription: Multiple issues were addressed by updating to tcpdump\nversion 4.9.3 and libpcap version 1.9.1\nCVE-2017-16808\nCVE-2018-10103\nCVE-2018-10105\nCVE-2018-14461\nCVE-2018-14462\nCVE-2018-14463\nCVE-2018-14464\nCVE-2018-14465\nCVE-2018-14466\nCVE-2018-14467\nCVE-2018-14468\nCVE-2018-14469\nCVE-2018-14470\nCVE-2018-14879\nCVE-2018-14880\nCVE-2018-14881\nCVE-2018-14882\nCVE-2018-16227\nCVE-2018-16228\nCVE-2018-16229\nCVE-2018-16230\nCVE-2018-16300\nCVE-2018-16301\nCVE-2018-16451\nCVE-2018-16452\nCVE-2019-15161\nCVE-2019-15162\nCVE-2019-15163\nCVE-2019-15164\nCVE-2019-15165\nCVE-2019-15166\nCVE-2019-15167\n\nAdditional recognition\n\nAccounts\nWe would like to acknowledge Kishan Bagaria (KishanBagaria.com) and\nTom Snelling of Loughborough University for their assistance. \n\nCore Data\nWe would like to acknowledge Natalie Silvanovich of Google Project\nZero for their assistance. \n\nInstallation note:\n\nmacOS Catalina 10.15.2, Security Update 2019-002 Mojave,\nSecurity Update 2019-007 High Sierra may be obtained\nfrom the Mac App Store or Apple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEM5FaaFRjww9EJgvRBz4uGe3y0M0FAl3wFrcACgkQBz4uGe3y\n0M2TvQ/+P5SX/Aky5E6q7Izgy1qXX9KueeMzJr1bXIlNziKYzq4FajQ55cP42pwy\nFrADnXX3AOhvZtJXBfgpO7/QUHupICuUbW5WQMQFiSTZFFwmHugrKvjIQqeFk5gS\nNFlVpQ8CEmUpzidZx9XKxRMjWWRTbT8RjrrK1BcK9SdF1OHPS7+whQuxpUBunw/o\n2OSPDPa0kFfkX6cWfTG/n/WU03UY0pAgvbydURICNnsiqyhXK9T4rdqhl5O9UlJJ\nOFuvyCAmqVI7RhcDKqFWdrSDap3fko7a/b7L3piqLkx2LrM9uVK9ll7Gf4BNd9h0\nJg5YbXx0ROZq+3uqky5zqx5bPoi8NpaQuld6xFCuOOLIcSJ/ywaV1EJzQaTJTZrB\nr6telp0NblBZldmMuy1Oty7tUOkTrr48j2YEKbLo7+SOcWI2tR8E8DVhUdvB+7Bc\nXIgN+tmj/3AZaOB7Tm6aTX6P82MucBCbenYB+1/JB8271XdBRpIHzEO6jDwnwwXd\nrkNq2xzE3TXTFwKx/nfjwK28/Jd8VgxrJTWfCKDzAOCqOidBHbkmitoQJQziCaUt\nj3cOERx+6xFAD5C9wddf3dcruIHtTP3B3CgK2gsTm8ZmsNCEaZPpzB1lW2k6/d9x\n9sGVqZpDKh7YuBAxI00KukwRK+vTxtw5ImbzAMA95OzUu+eMB7A=3s8r\n-----END PGP SIGNATURE-----\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Moderate: tcpdump security, bug fix, and enhancement update\nAdvisory ID: RHSA-2020:4760-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2020:4760\nIssue date: 2020-11-03\nCVE Names: CVE-2018-10103 CVE-2018-10105 CVE-2018-14461\n CVE-2018-14462 CVE-2018-14463 CVE-2018-14464\n CVE-2018-14465 CVE-2018-14466 CVE-2018-14467\n CVE-2018-14468 CVE-2018-14469 CVE-2018-14470\n CVE-2018-14879 CVE-2018-14880 CVE-2018-14881\n CVE-2018-14882 CVE-2018-16227 CVE-2018-16228\n CVE-2018-16229 CVE-2018-16230 CVE-2018-16300\n CVE-2018-16451 CVE-2018-16452 CVE-2019-15166\n====================================================================\n1. Summary:\n\nAn update for tcpdump is now available for Red Hat Enterprise Linux 8. \n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64\n\n3. Description:\n\nThe tcpdump packages contain the tcpdump utility for monitoring network\ntraffic. The tcpdump utility can capture and display the packet headers on\na particular network interface or on all interfaces. \n\nThe following packages have been upgraded to a later upstream version:\ntcpdump (4.9.3). \n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat\nEnterprise Linux 8.3 Release Notes linked from the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Package List:\n\nRed Hat Enterprise Linux AppStream (v. 8):\n\nSource:\ntcpdump-4.9.3-1.el8.src.rpm\n\naarch64:\ntcpdump-4.9.3-1.el8.aarch64.rpm\ntcpdump-debuginfo-4.9.3-1.el8.aarch64.rpm\ntcpdump-debugsource-4.9.3-1.el8.aarch64.rpm\n\nppc64le:\ntcpdump-4.9.3-1.el8.ppc64le.rpm\ntcpdump-debuginfo-4.9.3-1.el8.ppc64le.rpm\ntcpdump-debugsource-4.9.3-1.el8.ppc64le.rpm\n\ns390x:\ntcpdump-4.9.3-1.el8.s390x.rpm\ntcpdump-debuginfo-4.9.3-1.el8.s390x.rpm\ntcpdump-debugsource-4.9.3-1.el8.s390x.rpm\n\nx86_64:\ntcpdump-4.9.3-1.el8.x86_64.rpm\ntcpdump-debuginfo-4.9.3-1.el8.x86_64.rpm\ntcpdump-debugsource-4.9.3-1.el8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-10103\nhttps://access.redhat.com/security/cve/CVE-2018-10105\nhttps://access.redhat.com/security/cve/CVE-2018-14461\nhttps://access.redhat.com/security/cve/CVE-2018-14462\nhttps://access.redhat.com/security/cve/CVE-2018-14463\nhttps://access.redhat.com/security/cve/CVE-2018-14464\nhttps://access.redhat.com/security/cve/CVE-2018-14465\nhttps://access.redhat.com/security/cve/CVE-2018-14466\nhttps://access.redhat.com/security/cve/CVE-2018-14467\nhttps://access.redhat.com/security/cve/CVE-2018-14468\nhttps://access.redhat.com/security/cve/CVE-2018-14469\nhttps://access.redhat.com/security/cve/CVE-2018-14470\nhttps://access.redhat.com/security/cve/CVE-2018-14879\nhttps://access.redhat.com/security/cve/CVE-2018-14880\nhttps://access.redhat.com/security/cve/CVE-2018-14881\nhttps://access.redhat.com/security/cve/CVE-2018-14882\nhttps://access.redhat.com/security/cve/CVE-2018-16227\nhttps://access.redhat.com/security/cve/CVE-2018-16228\nhttps://access.redhat.com/security/cve/CVE-2018-16229\nhttps://access.redhat.com/security/cve/CVE-2018-16230\nhttps://access.redhat.com/security/cve/CVE-2018-16300\nhttps://access.redhat.com/security/cve/CVE-2018-16451\nhttps://access.redhat.com/security/cve/CVE-2018-16452\nhttps://access.redhat.com/security/cve/CVE-2019-15166\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBX6I4ENzjgjWX9erEAQhWpBAAl8gza241WtZUglkRZgl5MEblBH2i/YD7\nixrj7P/T6FmlkhbgotT6cWAD4v/oej0aV3VlgnlY9JI9iPGKvP6ZYu8jbaW50Lr+\nE1wDuI/6nAp/e6DLSYAe1qD52c06SrPdlMP40SE9ZQoTDe38Z8Uvfpm7X4CN9wgi\nAbGc3fUHkO5EDrYDpiT3UxF3X71yVq8/mWJRNo2T8IPxc6ufGJM524cFLV6KDx1q\nh0vDHxcv69wCwKXjYHBoU/X5Bq7k4KuTTbI4B5NgHouWrosUYcn5Bo9eiSfjY0C3\ncGD+CSQ/cBHzOleg7X6f3vrI7p6Gc0RG/npAIx7VfUucg8GYmdS2cjv93A5oqXJQ\nVIOGjtdX9dV6WEY2kkfJmjHJr4ehef6n6LML9U0F3OIMHYAeM9xObQYVU/iYH1db\n1kHQmLcQNR5RbNAm9VKuZdEU/V/IdM0bb1gGZEiuAbu1esSwV9h9zbke4Nf3pmC1\nqCmHF6sDyBrrHv1J0sr7dsd4gIlrNhXxtej+3FHCnKiuyMIyrPaKmsjidSeNyHTQ\noQVAxH4doUpiWeViH0/wEg7tcRuU6AFW64iFnMzXG2/iP4H5Oin9Gzsky+cdU+RH\nGfzzlTFeyNqhdxeoncnskYCKWN+rKCM+7kPVoSa2JwbZDgWFAIlFNkHsYSjBnYDD\n5ua+Acdmj44=1sro\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n", "sources": [ { "db": "NVD", "id": "CVE-2018-14462" }, { "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "db": "VULHUB", "id": "VHN-124624" }, { "db": "PACKETSTORM", "id": "160624" }, { "db": "PACKETSTORM", "id": "154710" }, { "db": "PACKETSTORM", "id": "156096" }, { "db": "PACKETSTORM", "id": "154931" }, { "db": "PACKETSTORM", "id": "161742" }, { "db": "PACKETSTORM", "id": "155645" }, { "db": "PACKETSTORM", "id": "159874" } ], "trust": 2.34 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2018-14462", "trust": 3.2 }, { "db": "PACKETSTORM", "id": "160624", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "159874", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "161742", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2018-016104", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "161546", "trust": 0.7 }, { "db": "CNNVD", "id": "CNNVD-201910-106", "trust": 0.7 }, { "db": "PACKETSTORM", "id": "154710", "trust": 0.7 }, { "db": "AUSCERT", "id": "ESB-2020.4513", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2021.0692", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2019.3814", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2021.0864", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2019.3840", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2019.4632", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.0289", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2019.3814.2", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.3885", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.4094", "trust": 0.6 }, { "db": "PACKETSTORM", "id": "156097", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-124624", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "156096", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "154931", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "155645", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-124624" }, { "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "db": "PACKETSTORM", "id": "160624" }, { "db": "PACKETSTORM", "id": "154710" }, { "db": "PACKETSTORM", "id": "156096" }, { "db": "PACKETSTORM", "id": "154931" }, { "db": "PACKETSTORM", "id": "161742" }, { "db": "PACKETSTORM", "id": "155645" }, { "db": "PACKETSTORM", "id": "159874" }, { "db": "CNNVD", "id": "CNNVD-201910-106" }, { "db": "NVD", "id": "CVE-2018-14462" } ] }, "id": "VAR-201910-1495", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-124624" } ], "trust": 0.01 }, "last_update_date": "2024-11-29T21:08:42.523000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "(for 4.9.3) CVE-2018-14462/ICMP: Add a missing bounds check", "trust": 0.8, "url": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3" }, { "title": "tcpdump/CHANGES", "trust": 0.8, "url": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES" }, { "title": "tcpdump Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98842" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "db": "CNNVD", "id": "CNNVD-201910-106" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-125", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-124624" }, { "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "db": "NVD", "id": "CVE-2018-14462" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.3, "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html" }, { "trust": 2.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14462" }, { "trust": 1.7, "url": "https://seclists.org/bugtraq/2019/oct/28" }, { "trust": 1.7, "url": "https://seclists.org/bugtraq/2019/dec/23" }, { "trust": 1.7, "url": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3" }, { "trust": 1.7, "url": "https://security.netapp.com/advisory/ntap-20200120-0001/" }, { "trust": 1.7, "url": "https://support.apple.com/kb/ht210788" }, { "trust": 1.7, "url": "https://www.debian.org/security/2019/dsa-4547" }, { "trust": 1.7, "url": "http://seclists.org/fulldisclosure/2019/dec/26" }, { "trust": 1.7, "url": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/changes" }, { "trust": 1.7, "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html" }, { "trust": 1.7, "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html" }, { "trust": 1.7, "url": "https://usn.ubuntu.com/4252-1/" }, { "trust": 1.7, "url": "https://usn.ubuntu.com/4252-2/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62xy42u6hy3h2apr5ehnwcz7saqnmmjn/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/fnyxf3iy2x65iod422sa6equulsgw7fn/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/r2udposgvjqiyc33sqbxmdxhh4qdsdmu/" }, { "trust": 0.9, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14462" }, { "trust": 0.7, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62xy42u6hy3h2apr5ehnwcz7saqnmmjn/" }, { "trust": 0.7, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/r2udposgvjqiyc33sqbxmdxhh4qdsdmu/" }, { "trust": 0.7, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/fnyxf3iy2x65iod422sa6equulsgw7fn/" }, { "trust": 0.7, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14466" }, { "trust": 0.7, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14882" }, { "trust": 0.7, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16230" }, { "trust": 0.7, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14470" }, { "trust": 0.7, "url": "https://support.apple.com/kb/ht201222" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14467" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-10103" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14469" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14465" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14881" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14463" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16228" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14879" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-10105" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14461" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16227" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14464" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14468" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-14880" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16300" }, { "trust": 0.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16229" }, { "trust": 0.6, "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20192674-1.html" }, { "trust": 0.6, "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914191-1.html" }, { "trust": 0.6, "url": "https://lists.debian.org/debian-security-announce/2019/msg00199.html" }, { "trust": 0.6, "url": "https://vigilance.fr/vulnerability/tcpdump-multiple-vulnerabilities-30492" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.4094/" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/154710/slackware-security-advisory-tcpdump-updates.html" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2021.0864" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2019.4632/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2019.3814.2/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.0289/" }, { "trust": 0.6, "url": "https://support.apple.com/en-us/ht210788" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2019.3814/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2021.0692" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/161546/red-hat-security-advisory-2020-5633-01.html" }, { "trust": 0.6, "url": "https://www.ibm.com/support/pages/node/1169974" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.4513/" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/156097/ubuntu-security-notice-usn-4252-2.html" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.3885/" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/161742/red-hat-security-advisory-2021-0799-01.html" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2019.3840/" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/159874/red-hat-security-advisory-2020-4760-01.html" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/160624/red-hat-security-advisory-2020-5605-01.html" }, { "trust": 0.5, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16452" }, { "trust": 0.5, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16451" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-16300" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-10105" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2019-15166" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-16230" }, { "trust": 0.3, "url": "https://access.redhat.com/articles/11258" }, { "trust": 0.3, "url": "https://bugzilla.redhat.com/):" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-16229" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14882" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-16227" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14461" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14464" }, { "trust": 0.3, "url": "https://access.redhat.com/security/team/contact/" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14469" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14880" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14468" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14466" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14467" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14462" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14881" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-16451" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-10103" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-16228" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14463" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14879" }, { "trust": 0.3, "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14470" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-14465" }, { "trust": 0.3, "url": "https://access.redhat.com/security/cve/cve-2018-16452" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-15166" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-16808" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-20907" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-13050" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9925" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9802" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-20218" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9895" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8625" }, { "trust": 0.2, "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-20388" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-15165" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-14382" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8812" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3899" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-16845" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8819" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11068" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3867" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8720" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9893" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-19221" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8808" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3902" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-18197" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-1751" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3900" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9805" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8820" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9807" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8769" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8710" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8813" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9850" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-7595" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8811" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-16168" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9803" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9862" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9327" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3885" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-15503" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-16935" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-20916" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-5018" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-19956" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-10018" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-14422" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8835" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8764" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8844" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3865" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-1730" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-15586" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3864" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-19906" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-20387" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-14391" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3862" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3901" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8823" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-1752" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-15903" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3895" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-8492" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-11793" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-20454" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2018-20843" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9894" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8816" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9843" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-13627" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-6405" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8771" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-13050" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3897" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9806" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8814" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-14889" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-20843" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8743" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-9915" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8815" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-13632" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-10029" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8783" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-20807" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-13630" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-14040" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-11068" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-13631" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8766" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8846" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3868" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2020-3894" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-8782" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-16301" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-18609" }, { "trust": 0.1, "url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_container_s" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-8177" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-1551" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2020:5605" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25660" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-14019" }, { "trust": 0.1, "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885700]" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-7720" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-8237" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14881" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14461" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14468" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16230" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15166" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14463" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15167" }, { "trust": 0.1, "url": "http://slackware.com" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14464" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16227" }, { "trust": 0.1, "url": "http://slackware.com/gpg-key" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14466" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10105" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14879" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16228" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16300" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16229" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14882" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16301" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14880" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16451" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14467" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14470" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14465" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10103" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-16452" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14469" }, { "trust": 0.1, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-16808" }, { "trust": 0.1, "url": "http://osuosl.org)" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-19519" }, { "trust": 0.1, "url": "https://usn.ubuntu.com/4252-1" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/tcpdump/4.9.3-0ubuntu0.16.04.1" }, { "trust": 0.1, "url": "https://launchpad.net/ubuntu/+source/tcpdump/4.9.3-0ubuntu0.18.04.1" }, { "trust": 0.1, "url": "https://www.debian.org/security/faq" }, { "trust": 0.1, "url": "https://security-tracker.debian.org/tracker/tcpdump" }, { "trust": 0.1, "url": "https://www.debian.org/security/" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-8624" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25684" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25705" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-26160" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-6829" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-12403" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2021-3156" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-1971" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-8623" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25683" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2021-20206" }, { "trust": 0.1, "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-29652" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-14351" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-24659" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-17450" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-12321" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-15999" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-14559" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-29661" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25682" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-12400" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-8622" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-28362" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25685" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2021:0799" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2021-3121" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25686" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25687" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-25681" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-8619" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-9283" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-27813" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2012-2668" }, { "trust": 0.1, "url": "https://support.apple.com/downloads/" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2012-1164" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2015-1545" }, { "trust": 0.1, "url": "https://www.apple.com/support/security/pgp/" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2013-4449" }, { "trust": 0.1, "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2020:4760" }, { "trust": 0.1, "url": "https://access.redhat.com/security/team/key/" } ], "sources": [ { "db": "VULHUB", "id": "VHN-124624" }, { "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "db": "PACKETSTORM", "id": "160624" }, { "db": "PACKETSTORM", "id": "154710" }, { "db": "PACKETSTORM", "id": "156096" }, { "db": "PACKETSTORM", "id": "154931" }, { "db": "PACKETSTORM", "id": "161742" }, { "db": "PACKETSTORM", "id": "155645" }, { "db": "PACKETSTORM", "id": "159874" }, { "db": "CNNVD", "id": "CNNVD-201910-106" }, { "db": "NVD", "id": "CVE-2018-14462" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-124624" }, { "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "db": "PACKETSTORM", "id": "160624" }, { "db": "PACKETSTORM", "id": "154710" }, { "db": "PACKETSTORM", "id": "156096" }, { "db": "PACKETSTORM", "id": "154931" }, { "db": "PACKETSTORM", "id": "161742" }, { "db": "PACKETSTORM", "id": "155645" }, { "db": "PACKETSTORM", "id": "159874" }, { "db": "CNNVD", "id": "CNNVD-201910-106" }, { "db": "NVD", "id": "CVE-2018-14462" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-10-03T00:00:00", "db": "VULHUB", "id": "VHN-124624" }, { "date": "2019-10-08T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "date": "2020-12-18T19:14:41", "db": "PACKETSTORM", "id": "160624" }, { "date": "2019-10-02T15:03:37", "db": "PACKETSTORM", "id": "154710" }, { "date": "2020-01-27T22:54:52", "db": "PACKETSTORM", "id": "156096" }, { "date": "2019-10-21T19:33:33", "db": "PACKETSTORM", "id": "154931" }, { "date": "2021-03-10T16:02:43", "db": "PACKETSTORM", "id": "161742" }, { "date": "2019-12-12T00:18:29", "db": "PACKETSTORM", "id": "155645" }, { "date": "2020-11-04T15:32:37", "db": "PACKETSTORM", "id": "159874" }, { "date": "2019-10-02T00:00:00", "db": "CNNVD", "id": "CNNVD-201910-106" }, { "date": "2019-10-03T16:15:11.490000", "db": "NVD", "id": "CVE-2018-14462" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-01-20T00:00:00", "db": "VULHUB", "id": "VHN-124624" }, { "date": "2019-10-08T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-016104" }, { "date": "2021-10-29T00:00:00", "db": "CNNVD", "id": "CNNVD-201910-106" }, { "date": "2024-11-21T03:49:07.383000", "db": "NVD", "id": "CVE-2018-14462" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "PACKETSTORM", "id": "160624" }, { "db": "PACKETSTORM", "id": "156096" }, { "db": "CNNVD", "id": "CNNVD-201910-106" } ], "trust": 0.8 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "tcpdump Vulnerable to out-of-bounds reading", "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-016104" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "buffer error", "sources": [ { "db": "CNNVD", "id": "CNNVD-201910-106" } ], "trust": 0.6 } }
gsd-2018-14462
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2018-14462", "description": "The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().", "id": "GSD-2018-14462", "references": [ "https://www.suse.com/security/cve/CVE-2018-14462.html", "https://www.debian.org/security/2019/dsa-4547", "https://access.redhat.com/errata/RHSA-2020:4760", "https://ubuntu.com/security/CVE-2018-14462", "https://advisories.mageia.org/CVE-2018-14462.html", "https://linux.oracle.com/cve/CVE-2018-14462.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2018-14462" ], "details": "The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().", "id": "GSD-2018-14462", "modified": "2023-12-13T01:22:38.222670Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-14462", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print()." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES", "refsource": "MISC", "url": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES" }, { "name": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3", "refsource": "CONFIRM", "url": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3" }, { "name": "[debian-lts-announce] 20191011 [SECURITY] [DLA 1955-1] tcpdump security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html" }, { "name": "openSUSE-SU-2019:2344", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html" }, { "name": "openSUSE-SU-2019:2348", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html" }, { "name": "20191021 [SECURITY] [DSA 4547-1] tcpdump security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Oct/28" }, { "name": "DSA-4547", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4547" }, { "name": "FEDORA-2019-85d92df70f", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/" }, { "name": "FEDORA-2019-d06bc63433", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/" }, { "name": "FEDORA-2019-6db0d5b9d9", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/" }, { "name": "https://support.apple.com/kb/HT210788", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT210788" }, { "name": "20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Dec/23" }, { "name": "20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2019/Dec/26" }, { "name": "https://security.netapp.com/advisory/ntap-20200120-0001/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20200120-0001/" }, { "name": "USN-4252-2", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4252-2/" }, { "name": "USN-4252-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4252-1/" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:tcpdump:tcpdump:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "4.9.3", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "5.1.0", "versionStartIncluding": "5.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:tcpdump:tcpdump:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "4.9.3", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "10.15.2", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-14462" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print()." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-125" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3", "refsource": "CONFIRM", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/the-tcpdump-group/tcpdump/commit/1a1bce0526a77b62e41531b00f8bb5e21fd4f3a3" }, { "name": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES", "refsource": "MISC", "tags": [ "Release Notes", "Third Party Advisory" ], "url": "https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES" }, { "name": "[debian-lts-announce] 20191011 [SECURITY] [DLA 1955-1] tcpdump security update", "refsource": "MLIST", "tags": [ "Third Party Advisory" ], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html" }, { "name": "openSUSE-SU-2019:2348", "refsource": "SUSE", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html" }, { "name": "openSUSE-SU-2019:2344", "refsource": "SUSE", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html" }, { "name": "20191021 [SECURITY] [DSA 4547-1] tcpdump security update", "refsource": "BUGTRAQ", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://seclists.org/bugtraq/2019/Oct/28" }, { "name": "DSA-4547", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2019/dsa-4547" }, { "name": "FEDORA-2019-85d92df70f", "refsource": "FEDORA", "tags": [ "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/" }, { "name": "FEDORA-2019-d06bc63433", "refsource": "FEDORA", "tags": [ "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/" }, { "name": "FEDORA-2019-6db0d5b9d9", "refsource": "FEDORA", "tags": [ "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/" }, { "name": "https://support.apple.com/kb/HT210788", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://support.apple.com/kb/HT210788" }, { "name": "20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "refsource": "BUGTRAQ", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://seclists.org/bugtraq/2019/Dec/23" }, { "name": "20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra", "refsource": "FULLDISC", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://seclists.org/fulldisclosure/2019/Dec/26" }, { "name": "https://security.netapp.com/advisory/ntap-20200120-0001/", "refsource": "CONFIRM", "tags": [], "url": "https://security.netapp.com/advisory/ntap-20200120-0001/" }, { "name": "USN-4252-2", "refsource": "UBUNTU", "tags": [], "url": "https://usn.ubuntu.com/4252-2/" }, { "name": "USN-4252-1", "refsource": "UBUNTU", "tags": [], "url": "https://usn.ubuntu.com/4252-1/" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } }, "lastModifiedDate": "2023-08-16T14:17Z", "publishedDate": "2019-10-03T16:15Z" } } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.