CVE-2018-1000140: canonical ubuntu_linux Out-of-bounds Write
Vulnerability summary
CVE-2018-1000140 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 9.34% chance of exploitation in the next 30 days, higher than 95.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 23-03-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
9.34%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 9.34% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (lgtm.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Suse23 products
- librelp&distro=HPE Helion OpenStack 8< 1.2.15-3.6.3
- librelp&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 1.2.7-3.3.1
- librelp&distro=SUSE Linux Enterprise Server 12 SP2< 1.2.7-3.3.1
- librelp&distro=SUSE Linux Enterprise Server 12 SP3< 1.2.12-3.3.1
- librelp&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 1.2.15-3.6.3
Redhat9 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus6.6 | 7.2 | 7.3 | 7.4 | 7.6
- enterprise_linux_server_eus6.7 | 7.3 | 7.4 | 7.5 | 7.6
- enterprise_linux_server_tus6.6 | 7.2 | 7.3 | 7.4 | 7.6
Debian2 products
- librelp< 1.2.15-1 | < 1.2.7-2+deb8u1 | < 1.2.12-1+deb9u1
- debian_linuxEOL8.0 | 9.0
Mageia2 products
- librelp< 1.2.7-3.1.mga5
- librelp< 1.2.13-1.1.mga6
Canonical1 product
- ubuntu_linuxEOL14.04
Rsyslog1 product
- librelp≤ 1.2.14
Ubuntu1 product
- librelp< 1.2.2-2ubuntu1.1 | < 1.2.9-1ubuntu0.1~esm1 | < 1.2.14-3ubuntu0.1~esm1
7 vendors · 39 products
References
38 links- github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.cPatchThird Party AdvisoryREPORT
