CVE-2018-16864
Detail
Modified This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.
Description
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 Severity and Vector Strings:
Vector:
(AV:L/AC:L/Au:N/C:P/I:P/A:P)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to nvd@nist.gov .
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-770
Allocation of Resources Without Limits or Throttling
NIST  
Red Hat, Inc.  
Change History
26 change records found show
changes
CVE Modified by CVE 11/20/2024 10:53:28 PM
Action
Type
Old Value
New Value
Added
Reference
http://www.openwall.com/lists/oss-security/2021/07/20/2
Added
Reference
http://www.securityfocus.com/bid/106523
Added
Reference
https://access.redhat.com/errata/RHBA-2019:0327
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0049
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0204
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0271
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0342
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0361
Added
Reference
https://access.redhat.com/errata/RHSA-2019:2402
Added
Reference
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16864
Added
Reference
https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html
Added
Reference
https://security.gentoo.org/glsa/201903-07
Added
Reference
https://security.netapp.com/advisory/ntap-20190117-0001/
Added
Reference
https://usn.ubuntu.com/3855-1/
Added
Reference
https://www.debian.org/security/2019/dsa-4367
Added
Reference
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Added
Reference
https://www.qualys.com/2019/01/09/system-down/system-down.txt
CVE Modified by Red Hat, Inc. 5/14/2024 1:06:10 AM
Action
Type
Old Value
New Value
CVE Modified by Red Hat, Inc. 2/12/2023 11:52:10 PM
Action
Type
Old Value
New Value
Changed
Description
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate privileges.
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.
Added
CWE
Red Hat, Inc. CWE-770
Removed
Reference
https://access.redhat.com/security/cve/CVE-2018-16864 [No Types Assigned]
Removed
Reference
https://bugzilla.redhat.com/show_bug.cgi?id=1653855 [No Types Assigned]
CVE Modified by Red Hat, Inc. 2/02/2023 4:18:13 PM
Action
Type
Old Value
New Value
Changed
Description
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate privileges.
Removed
CWE
Red Hat, Inc. CWE-770
Added
Reference
https://access.redhat.com/security/cve/CVE-2018-16864 [No Types Assigned]
Added
Reference
https://bugzilla.redhat.com/show_bug.cgi?id=1653855 [No Types Assigned]
Modified Analysis by NIST 1/31/2022 1:31:14 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:a:freedesktop:systemd:*:*:*:*:*:*:*:* versions up to (including) 240
OR
*cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* versions up to (including) 240
Changed
Reference Type
http://www.openwall.com/lists/oss-security/2021/07/20/2 No Types Assigned
http://www.openwall.com/lists/oss-security/2021/07/20/2 Mailing List
CVE Modified by Red Hat, Inc. 7/20/2021 11:15:09 AM
Action
Type
Old Value
New Value
Added
Reference
http://www.openwall.com/lists/oss-security/2021/07/20/2 [No Types Assigned]
CPE Deprecation Remap by NIST 10/15/2020 9:28:17 AM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:o:redhat:virtualization:4.0:*:*:*:*:*:*:*
OR
*cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
Modified Analysis by NIST 9/18/2020 12:49:45 PM
Action
Type
Old Value
New Value
Added
CVSS V3.1
NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Removed
CVSS V3
NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added
CWE
NIST CWE-770
Removed
CWE
NIST CWE-119
Changed
CPE Configuration
Record truncated, showing 500 of 730 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Record truncated, showing 500 of 868 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:2402 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:2402 Third Party Advisory
CVE Modified by Red Hat, Inc. 10/09/2019 7:36:23 PM
Action
Type
Old Value
New Value
Added
CVSS V3
Red Hat, Inc. AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Added
CWE
Red Hat, Inc. CWE-770
CVE Modified by Red Hat, Inc. 8/07/2019 10:15:12 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:2402 [No Types Assigned]
Modified Analysis by NIST 4/26/2019 12:21:44 PM
Action
Type
Old Value
New Value
Added
CPE Configuration
OR
*cpe:2.3:a:oracle:communications_session_border_controller:8.0.0:*:*:*:*:*:*:*
*cpe:2.3:a:oracle:communications_session_border_controller:8.1.0:*:*:*:*:*:*:*
*cpe:2.3:a:oracle:communications_session_border_controller:8.2.0:*:*:*:*:*:*:*
*cpe:2.3:a:oracle:enterprise_communications_broker:3.0.0:*:*:*:*:*:*:*
*cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*
Changed
Reference Type
https://access.redhat.com/errata/RHBA-2019:0327 No Types Assigned
https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
Changed
Reference Type
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html No Types Assigned
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
CVE Modified by Red Hat, Inc. 4/24/2019 2:29:17 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHBA-2019:0327 [No Types Assigned]
CVE Modified by Red Hat, Inc. 4/23/2019 3:31:56 PM
Action
Type
Old Value
New Value
Added
Reference
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html [No Types Assigned]
Modified Analysis by NIST 3/12/2019 8:50:01 AM
Action
Type
Old Value
New Value
Changed
Reference Type
https://security.gentoo.org/glsa/201903-07 No Types Assigned
https://security.gentoo.org/glsa/201903-07 Third Party Advisory
CVE Modified by Red Hat, Inc. 3/11/2019 7:29:02 AM
Action
Type
Old Value
New Value
Added
Reference
https://security.gentoo.org/glsa/201903-07 [No Types Assigned]
Modified Analysis by NIST 3/04/2019 3:13:02 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
Record truncated, showing 500 of 674 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Record truncated, showing 500 of 730 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0342 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0342 Third Party Advisory
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0361 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0361 Third Party Advisory
CVE Modified by Red Hat, Inc. 2/19/2019 6:29:07 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0361 [No Types Assigned]
CVE Modified by Red Hat, Inc. 2/14/2019 6:29:00 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0342 [No Types Assigned]
Initial Analysis by NIST 2/08/2019 3:37:29 PM
Action
Type
Old Value
New Value
Added
CVSS V3
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added
CVSS V2
(AV:L/AC:L/Au:N/C:P/I:P/A:P)
Added
CWE
CWE-119
Added
CPE Configuration
OR
*cpe:2.3:a:freedesktop:systemd:*:*:*:*:*:*:*:* versions up to (including) 240
Added
CPE Configuration
OR
*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
*cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Added
CPE Configuration
OR
*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Added
CPE Configuration
Record truncated, showing 500 of 674 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Changed
Reference Type
http://www.securityfocus.com/bid/106523 No Types Assigned
http://www.securityfocus.com/bid/106523 Third Party Advisory, VDB Entry
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0049 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0049 Third Party Advisory
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0204 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0204 Third Party Advisory
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0271 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0271 Third Party Advisory
Changed
Reference Type
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16864 No Types Assigned
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16864 Issue Tracking, Patch, Third Party Advisory
Changed
Reference Type
https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html No Types Assigned
https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html Third Party Advisory
Changed
Reference Type
https://security.netapp.com/advisory/ntap-20190117-0001/ No Types Assigned
https://security.netapp.com/advisory/ntap-20190117-0001/ Third Party Advisory
Changed
Reference Type
https://usn.ubuntu.com/3855-1/ No Types Assigned
https://usn.ubuntu.com/3855-1/ Third Party Advisory
Changed
Reference Type
https://www.debian.org/security/2019/dsa-4367 No Types Assigned
https://www.debian.org/security/2019/dsa-4367 Third Party Advisory
Changed
Reference Type
https://www.qualys.com/2019/01/09/system-down/system-down.txt No Types Assigned
https://www.qualys.com/2019/01/09/system-down/system-down.txt Exploit, Third Party Advisory
CVE Modified by Red Hat, Inc. 2/05/2019 6:29:06 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0271 [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/30/2019 10:29:03 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0204 [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/23/2019 6:29:02 AM
Action
Type
Old Value
New Value
Added
Reference
https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/18/2019 6:29:00 AM
Action
Type
Old Value
New Value
Added
Reference
https://security.netapp.com/advisory/ntap-20190117-0001/ [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/15/2019 6:29:03 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0049 [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/14/2019 6:29:01 AM
Action
Type
Old Value
New Value
Added
Reference
https://www.debian.org/security/2019/dsa-4367 [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/12/2019 6:29:01 AM
Action
Type
Old Value
New Value
Added
Reference
http://www.securityfocus.com/bid/106523 [No Types Assigned]
Added
Reference
https://usn.ubuntu.com/3855-1/ [No Types Assigned]
Quick Info
CVE Dictionary Entry: CVE-2018-16864 NVD
Published Date: 01/11/2019 NVD
Last Modified: 11/20/2024
Source: Red Hat, Inc.
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
