NVD

CVE-2018-16865 Detail

Current Description

An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the journal socket. A local attacker, or a remote one if systemd-journal-remote is used, may use this flaw to crash systemd-journald or execute code with journald privileges. Versions through v240 are vulnerable.

View Analysis Description

Severity

CVSS 3.x Severity and Metrics:

NIST: NVD

Base Score: 7.8 HIGH

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Nist CVSS score does not match with CNA score

CNA: Red Hat, Inc.

Base Score: 7.5 HIGH

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.

Note: It is possible that the NVD CVSS may not match that of the CNA. The most common reason for this is that publicly available information does not provide sufficient detail or that information simply was not available at the time the CVSS vector string was assigned.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2019/May/21	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/05/10/4	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/07/20/2	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/106525	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHBA-2019:0327	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0049	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0204	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0271	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0342	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0361	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2402	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16865	Issue Tracking Patch
https://lists.debian.org/debian-lts-announce/2019/01/msg00016.html	Mailing List Third Party Advisory
https://seclists.org/bugtraq/2019/May/25	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201903-07	Third Party Advisory
https://security.netapp.com/advisory/ntap-20190117-0001/	Third Party Advisory
https://usn.ubuntu.com/3855-1/	Third Party Advisory
https://www.debian.org/security/2019/dsa-4367	Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Third Party Advisory
https://www.qualys.com/2019/01/09/system-down/system-down.txt	Exploit Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-770	Allocation of Resources Without Limits or Throttling	NIST Red Hat, Inc.

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

27 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2018-16865
NVD Published Date:
01/11/2019
NVD Last Modified:
01/31/2022
Source:
Red Hat, Inc.

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2018-16865 Detail

Current Description

Analysis Description

Severity

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

Modified Analysis 1/31/2022 1:34:56 PM

CVE Modified by Red Hat, Inc. 7/20/2021 11:15:09 AM

CPE Deprecation Remap 10/15/2020 9:28:17 AM

Modified Analysis 9/18/2020 12:49:29 PM

CVE Modified by Red Hat, Inc. 10/09/2019 7:36:24 PM

CVE Modified by Red Hat, Inc. 8/07/2019 10:15:12 AM

Modified Analysis 6/03/2019 1:15:54 PM

CVE Modified by Red Hat, Inc. 5/13/2019 4:29:00 PM

CVE Modified by Red Hat, Inc. 5/13/2019 2:29:00 PM

CVE Modified by Red Hat, Inc. 5/13/2019 1:29:00 PM

CVE Modified by Red Hat, Inc. 5/10/2019 11:29:00 AM

Modified Analysis 4/26/2019 12:20:45 PM

CVE Modified by Red Hat, Inc. 4/24/2019 2:29:18 AM

CVE Modified by Red Hat, Inc. 4/23/2019 3:31:57 PM

Modified Analysis 3/12/2019 8:51:29 AM

CVE Modified by Red Hat, Inc. 3/11/2019 7:29:02 AM

Modified Analysis 3/04/2019 2:48:29 PM

CVE Modified by Red Hat, Inc. 2/19/2019 6:29:07 AM

CVE Modified by Red Hat, Inc. 2/14/2019 6:29:00 AM

Initial Analysis 2/08/2019 3:44:55 PM

CVE Modified by Red Hat, Inc. 2/05/2019 6:29:06 AM

CVE Modified by Red Hat, Inc. 1/30/2019 10:29:04 AM

CVE Modified by Red Hat, Inc. 1/23/2019 6:29:02 AM

CVE Modified by Red Hat, Inc. 1/18/2019 6:29:00 AM

CVE Modified by Red Hat, Inc. 1/15/2019 6:29:03 AM

CVE Modified by Red Hat, Inc. 1/14/2019 6:29:01 AM

CVE Modified by Red Hat, Inc. 1/12/2019 6:29:01 AM

Quick Info