CVE-2018-11219: debian debian_linux Integer Overflow or Wraparound
CVSS: 9.8v3.0CriticalModified
AliasesALPINE-CVE-2018-11219UBUNTU-CVE-2018-11219DEBIAN-CVE-2018-11219
Published 17-06-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-11219 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in debian debian_linux. EPSS estimates a 6.97% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.0 (NVD)EPSS score
6.97%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 7 · Related 1Timeline
- 17-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
6.97%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.97% on 18-09-2026
18-09-202618-10-2026
EPSS score6.97%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (antirez.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- redis< 5:4.0.10-1
- debian_linuxEOL9.0
Alpine1 product
- redis≥ 4.0, < 3.2.12-r0 | ≥ 4.0, < 4.0.10-r0
Oracle1 product
- communications_operations_monitor3.4 | 4.0
Redhat1 product
- openstack10 | 13
Redislabs1 product
- redis< 3.2.12 | ≥ 4.0, < 4.0.10 | 5.0:rc1
Ubuntu1 product
- redis< 2:2.8.4-2ubuntu0.2 | < 2:3.0.6-1ubuntu0.2 | < 5:4.0.9-1ubuntu0.1
6 vendors · 7 products
References
17 links- github.com/antirez/redis/commit/1eb08bcd4634ae42ec45e8284923ac048beaa4c3X Refsource MISCPatchThird Party AdvisoryREPORT
- raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTESX Refsource MISCThird Party AdvisoryREPORT
- github.com/antirez/redis/commit/e89086e09a38cc6713bcd4b9c29abf92cf393936X Refsource MISCPatchThird Party AdvisoryREPORT
- raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTESX Refsource MISCThird Party AdvisoryREPORT
Show all 17 references
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlX Refsource MISCPatchThird Party Advisory