Vulnerability CVE-2018-14638


Published: 2018-09-14   Modified: 2018-09-15

Description:
A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.

Type:

CWE-415

(Double Free)

Vendor: Redhat
Product: Enterprise linux server eus 
Version: 7.6; 7.5;
Product: Enterprise linux server tus 
Version: 7.6;
Product: Enterprise linux aus 
Version: 7.6;
Product: Enterprise linux server 
Version: 7.0;
Product: Enterprise linux workstation 
Version: 7.0;
Product: Enterprise linux desktop 
Version: 7.0;
Vendor: Fedoraproject
Product: 389 directory server 
Version:
1.3.8.3
1.3.8.2
1.3.8.1
1.3.7.9
1.3.7.8
1.3.7.7
1.3.7.6
1.3.7.5
1.3.7.4
1.3.7.3
1.3.7.2
1.3.7.10
1.3.7.1
1.3.6.9
1.3.6.8
1.3.6.7
1.3.6.6
1.3.6.5
1.3.6.4
1.3.6.3
1.3.6.2
1.3.6.15
1.3.6.14
1.3.6.13
1.3.6.12
1.3.6.11
1.3.6.10
1.3.6.1
1.3.6.0
1.3.6
1.3.5.4
1.3.5.3
1.3.5.2
1.3.5.19
1.3.5.18
1.3.5.17
1.3.5.16
1.3.5.15
1.3.5.14
1.3.5.13
1.3.4.9
1.3.4.8
1.3.4.5
1.3.4.4
1.3.4.14
1.3.4.1
1.3.4.0
1.3.3.9
1.3.3.8
1.3.3.5
1.3.3.3
1.3.3.2
1.3.3.14
1.3.3.13
1.3.3.12
1.3.3.11
1.3.3.10
1.3.3.0
1.3.2.9
1.3.2.8
1.3.2.7
1.3.2.6
1.3.2.5
1.3.2.4
1.3.2.3
1.3.2.27
1.3.2.26
1.3.2.24
1.3.2.23
1.3.2.22
1.3.2.2
1.3.2.19
1.3.2.16
1.3.2.13
1.3.2.11
1.3.2.10
1.3.1.9
1.3.1.8
1.3.1.7
1.3.1.6
1.3.1.5
1.3.1.4
1.3.1.3
1.3.1.22
1.3.1.2
1.3.1.19
1.3.1.18
1.3.1.17
1.3.1.16
1.3.1.15
1.3.1.14
1.3.1.13
1.3.1.12
See more versions on NVD

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial

 References:
https://access.redhat.com/errata/RHSA-2018:2757
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14638
https://pagure.io/389-ds-base/c/78fc627accacfa4061ce48977e22301f81ea8d73

Related CVE
CVE-2019-7165
A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.
CVE-2019-5839
Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website URL validation via a crafted URL.
CVE-2019-5838
Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extension to bypass restrictions on file URIs via a crafted Chrome Extension.
CVE-2019-5837
Resource size information leakage in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2019-5836
Heap buffer overflow in ANGLE in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2019-5835
Object lifecycle issue in SwiftShader in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVE-2019-5834
Insufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
CVE-2019-5833
Incorrect dialog box scoping in browser in Google Chrome on Android prior to 75.0.3770.80 allowed a remote attacker to display misleading security UI via a crafted HTML page.

Copyright 2019, cxsecurity.com

 

Back to Top