CVE-2018-14879 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7 HIGH	LOCAL	HIGH	NONE	CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 80%

Vendor	Product	Version
f5	traffix_signaling_delivery_controller	5.0.0 ≤ 𝑥 ≤ 5.1.0
tcpdump	tcpdump	𝑥 < 4.9.3
apple	mac_os_x	𝑥 < 10.15.2
debian	debian_linux	8.0
debian	debian_linux	9.0
debian	debian_linux	10.0
opensuse	leap	15.0
opensuse	leap	15.1
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

tcpdump

bullseye	4.99.0-2+deb11u1 fixed
bookworm	4.99.3-1 fixed
sid	4.99.5-1 fixed
trixie	4.99.5-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

tcpdump

eoan	not-affected
disco	ignored
bionic	Fixed 4.9.3-0ubuntu0.18.04.1 released
xenial	Fixed 4.9.3-0ubuntu0.16.04.1 released
trusty	Fixed 4.9.3-0ubuntu0.14.04.1+esm1 released

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html

http://seclists.org/fulldisclosure/2019/Dec/26

https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES

https://github.com/the-tcpdump-group/tcpdump/commit/9ba91381954ad325ea4fd26b9c65a8bd9a2a85b6

https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/

https://seclists.org/bugtraq/2019/Dec/23

https://seclists.org/bugtraq/2019/Oct/28

https://security.netapp.com/advisory/ntap-20200120-0001/

https://support.apple.com/kb/HT210788

https://support.f5.com/csp/article/K51512510?utm_source=f5support&amp%3Butm_medium=RSS

https://usn.ubuntu.com/4252-1/

https://usn.ubuntu.com/4252-2/

https://www.debian.org/security/2019/dsa-4547

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00050.html

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00053.html

http://seclists.org/fulldisclosure/2019/Dec/26

https://github.com/the-tcpdump-group/tcpdump/blob/tcpdump-4.9/CHANGES

https://github.com/the-tcpdump-group/tcpdump/commit/9ba91381954ad325ea4fd26b9c65a8bd9a2a85b6

https://lists.debian.org/debian-lts-announce/2019/10/msg00015.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62XY42U6HY3H2APR5EHNWCZ7SAQNMMJN/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNYXF3IY2X65IOD422SA6EQUULSGW7FN/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R2UDPOSGVJQIYC33SQBXMDXHH4QDSDMU/

https://seclists.org/bugtraq/2019/Dec/23

https://seclists.org/bugtraq/2019/Oct/28

https://security.netapp.com/advisory/ntap-20200120-0001/

https://support.apple.com/kb/HT210788

https://support.f5.com/csp/article/K51512510?utm_source=f5support&amp%3Butm_medium=RSS

https://usn.ubuntu.com/4252-1/

https://usn.ubuntu.com/4252-2/

https://www.debian.org/security/2019/dsa-4547