CVE-2018-16864
Detail
Current Description
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.
Analysis
Description
An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through v240 are vulnerable.
Severity
CVSS
Version 3.x
CVSS
Version 2.0
CVSS 3.x Severity and Metrics:
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 Severity and Metrics:
Vector:
(AV:L/AC:L/Au:N/C:P/I:P/A:P)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to nvd@nist.gov .
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-770
Allocation of Resources Without Limits or Throttling
NIST
Red Hat, Inc.
Change History
20 change records found show changes
CPE Deprecation Remap 10/15/2020 9:28:17 AM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:o:redhat:virtualization:4.0:*:*:*:*:*:*:*
OR
*cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
Modified Analysis 9/18/2020 12:49:45 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
Record truncated, showing 500 of 730 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Record truncated, showing 500 of 868 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Removed
CVSS V3
NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added
CVSS V3.1
NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added
CWE
NIST CWE-770
Removed
CWE
NIST CWE-119
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:2402 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:2402 Third Party Advisory
CVE Modified by Red Hat, Inc. 10/09/2019 7:36:23 PM
Action
Type
Old Value
New Value
Added
CVSS V3
Red Hat, Inc. AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Added
CWE
Red Hat, Inc. CWE-770
CVE Modified by Red Hat, Inc. 8/07/2019 10:15:12 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:2402 [No Types Assigned]
Modified Analysis 4/26/2019 12:21:44 PM
Action
Type
Old Value
New Value
Added
CPE Configuration
OR
*cpe:2.3:a:oracle:communications_session_border_controller:8.0.0:*:*:*:*:*:*:*
*cpe:2.3:a:oracle:communications_session_border_controller:8.1.0:*:*:*:*:*:*:*
*cpe:2.3:a:oracle:communications_session_border_controller:8.2.0:*:*:*:*:*:*:*
*cpe:2.3:a:oracle:enterprise_communications_broker:3.0.0:*:*:*:*:*:*:*
*cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*
Changed
Reference Type
https://access.redhat.com/errata/RHBA-2019:0327 No Types Assigned
https://access.redhat.com/errata/RHBA-2019:0327 Third Party Advisory
Changed
Reference Type
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html No Types Assigned
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch, Third Party Advisory
CVE Modified by Red Hat, Inc. 4/24/2019 2:29:17 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHBA-2019:0327 [No Types Assigned]
CVE Modified by Red Hat, Inc. 4/23/2019 3:31:56 PM
Action
Type
Old Value
New Value
Added
Reference
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html [No Types Assigned]
Modified Analysis 3/12/2019 8:50:01 AM
Action
Type
Old Value
New Value
Changed
Reference Type
https://security.gentoo.org/glsa/201903-07 No Types Assigned
https://security.gentoo.org/glsa/201903-07 Third Party Advisory
CVE Modified by Red Hat, Inc. 3/11/2019 7:29:02 AM
Action
Type
Old Value
New Value
Added
Reference
https://security.gentoo.org/glsa/201903-07 [No Types Assigned]
Modified Analysis 3/04/2019 3:13:02 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
Record truncated, showing 500 of 674 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Record truncated, showing 500 of 730 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0342 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0342 Third Party Advisory
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0361 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0361 Third Party Advisory
CVE Modified by Red Hat, Inc. 2/19/2019 6:29:07 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0361 [No Types Assigned]
CVE Modified by Red Hat, Inc. 2/14/2019 6:29:00 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0342 [No Types Assigned]
Initial Analysis 2/08/2019 3:37:29 PM
Action
Type
Old Value
New Value
Added
CPE Configuration
OR
*cpe:2.3:a:freedesktop:systemd:*:*:*:*:*:*:*:* versions up to (including) 240
Added
CPE Configuration
OR
*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
*cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Added
CPE Configuration
OR
*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Added
CPE Configuration
Record truncated, showing 500 of 674 characters. View Entire Change Record OR
*cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
*cpe:2.3:o:redhat:enterprise
Added
CVSS V2
(AV:L/AC:L/Au:N/C:P/I:P/A:P)
Added
CVSS V3
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added
CWE
CWE-119
Changed
Reference Type
http://www.securityfocus.com/bid/106523 No Types Assigned
http://www.securityfocus.com/bid/106523 Third Party Advisory, VDB Entry
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0049 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0049 Third Party Advisory
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0204 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0204 Third Party Advisory
Changed
Reference Type
https://access.redhat.com/errata/RHSA-2019:0271 No Types Assigned
https://access.redhat.com/errata/RHSA-2019:0271 Third Party Advisory
Changed
Reference Type
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16864 No Types Assigned
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16864 Issue Tracking, Patch, Third Party Advisory
Changed
Reference Type
https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html No Types Assigned
https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html Third Party Advisory
Changed
Reference Type
https://security.netapp.com/advisory/ntap-20190117-0001/ No Types Assigned
https://security.netapp.com/advisory/ntap-20190117-0001/ Third Party Advisory
Changed
Reference Type
https://usn.ubuntu.com/3855-1/ No Types Assigned
https://usn.ubuntu.com/3855-1/ Third Party Advisory
Changed
Reference Type
https://www.debian.org/security/2019/dsa-4367 No Types Assigned
https://www.debian.org/security/2019/dsa-4367 Third Party Advisory
Changed
Reference Type
https://www.qualys.com/2019/01/09/system-down/system-down.txt No Types Assigned
https://www.qualys.com/2019/01/09/system-down/system-down.txt Exploit, Third Party Advisory
CVE Modified by Red Hat, Inc. 2/05/2019 6:29:06 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0271 [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/30/2019 10:29:03 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0204 [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/23/2019 6:29:02 AM
Action
Type
Old Value
New Value
Added
Reference
https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/18/2019 6:29:00 AM
Action
Type
Old Value
New Value
Added
Reference
https://security.netapp.com/advisory/ntap-20190117-0001/ [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/15/2019 6:29:03 AM
Action
Type
Old Value
New Value
Added
Reference
https://access.redhat.com/errata/RHSA-2019:0049 [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/14/2019 6:29:01 AM
Action
Type
Old Value
New Value
Added
Reference
https://www.debian.org/security/2019/dsa-4367 [No Types Assigned]
CVE Modified by Red Hat, Inc. 1/12/2019 6:29:01 AM
Action
Type
Old Value
New Value
Added
Reference
http://www.securityfocus.com/bid/106523 [No Types Assigned]
Added
Reference
https://usn.ubuntu.com/3855-1/ [No Types Assigned]
Quick Info
CVE Dictionary Entry: CVE-2018-16864 NVD
Published Date: 01/11/2019 NVD
Last Modified: 10/15/2020
Source: Red Hat, Inc.
