CVE-2018-18311: apple mac_os_x Integer Overflow or Wraparound

Modified

AliasesALPINE-CVE-2018-18311SUSE-SU-2019:2264-1RHSA-2019:0109+6 more

Published 07-12-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-18311 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in apple mac_os_x. EPSS estimates a 11.68% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 12% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

11.68%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 3

DSA-4347-1 OPENSUSE-SU-2024:11158-1 RHSA-2019:0001 RHSA-2019:0010 RHSA-2026:7604 SUSE-SU-2018:4187-1+1 more

Timeline

07-12-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

11.68%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 11.68% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat28 products

enterprise_linuxEOL6.0 | 7.0 | 7.4 | 7.5 | 7.6
enterprise_linux_desktop7.0
enterprise_linux_eus7.6
enterprise_linux_server7.0
enterprise_linux_server_aus7.6

enterprise_linux_server_tus7.6
enterprise_linux_workstation7.0
openshift_container_platform3.11
perl< 4:5.16.3-294.el7_6 | < 4:5.16.3-292.el7_5.1 | < 4:5.16.3-292.el7_4.1 | < 4:5.16.3-291.el7_3.1
perl-core< 0:5.16.3-294.el7_6 | < 0:5.16.3-292.el7_5.1 | < 0:5.16.3-292.el7_4.1 | < 0:5.16.3-291.el7_3.1
perl-CPAN< 0:1.9800-294.el7_6 | < 0:1.9800-292.el7_5.1 | < 0:1.9800-292.el7_4.1 | < 0:1.9800-291.el7_3.1
perl-debuginfo< 4:5.16.3-294.el7_6 | < 4:5.16.3-292.el7_5.1 | < 4:5.16.3-292.el7_4.1 | < 4:5.16.3-291.el7_3.1
perl-devel< 4:5.16.3-294.el7_6 | < 4:5.16.3-292.el7_5.1 | < 4:5.16.3-292.el7_4.1 | < 4:5.16.3-291.el7_3.1
perl-ExtUtils-CBuilder< 1:0.28.2.6-294.el7_6 | < 1:0.28.2.6-292.el7_5.1 | < 1:0.28.2.6-292.el7_4.1 | < 1:0.28.2.6-291.el7_3.1
perl-ExtUtils-Embed< 0:1.30-294.el7_6 | < 0:1.30-292.el7_5.1 | < 0:1.30-292.el7_4.1 | < 0:1.30-291.el7_3.1
perl-ExtUtils-Install< 0:1.58-294.el7_6 | < 0:1.58-292.el7_5.1 | < 0:1.58-292.el7_4.1 | < 0:1.58-291.el7_3.1
perl-IO-Zlib< 1:1.10-294.el7_6 | < 1:1.10-292.el7_5.1 | < 1:1.10-292.el7_4.1 | < 1:1.10-291.el7_3.1
perl-libs< 4:5.16.3-294.el7_6 | < 4:5.16.3-292.el7_5.1 | < 4:5.16.3-292.el7_4.1 | < 4:5.16.3-291.el7_3.1
perl-Locale-Maketext-Simple< 1:0.21-294.el7_6 | < 1:0.21-292.el7_5.1 | < 1:0.21-292.el7_4.1 | < 1:0.21-291.el7_3.1
perl-macros< 4:5.16.3-294.el7_6 | < 4:5.16.3-292.el7_5.1 | < 4:5.16.3-292.el7_4.1 | < 4:5.16.3-291.el7_3.1
perl-Module-CoreList< 1:2.76.02-294.el7_6 | < 1:2.76.02-292.el7_5.1 | < 1:2.76.02-292.el7_4.1 | < 1:2.76.02-291.el7_3.1
perl-Module-Loaded< 1:0.08-294.el7_6 | < 1:0.08-292.el7_5.1 | < 1:0.08-292.el7_4.1 | < 1:0.08-291.el7_3.1
perl-Object-Accessor< 1:0.42-294.el7_6 | < 1:0.42-292.el7_5.1 | < 1:0.42-292.el7_4.1 | < 1:0.42-291.el7_3.1
perl-Package-Constants< 1:0.02-294.el7_6 | < 1:0.02-292.el7_5.1 | < 1:0.02-292.el7_4.1 | < 1:0.02-291.el7_3.1
perl-Perl4-CoreLibs< 0:0.001-291.el7_3.1
perl-Pod-Escapes< 1:1.04-294.el7_6 | < 1:1.04-292.el7_5.1 | < 1:1.04-292.el7_4.1 | < 1:1.04-291.el7_3.1
perl-tests< 4:5.16.3-294.el7_6 | < 4:5.16.3-292.el7_5.1 | < 4:5.16.3-292.el7_4.1 | < 4:5.16.3-291.el7_3.1
perl-Time-Piece< 0:1.20.1-294.el7_6 | < 0:1.20.1-292.el7_5.1 | < 0:1.20.1-292.el7_4.1 | < 0:1.20.1-291.el7_3.1

Show all 28

Suse17 products

perl&distro=HPE Helion OpenStack 8< 5.18.2-12.20.1
perl&distro=SUSE Enterprise Storage 4< 5.18.2-12.20.1
perl&distro=SUSE Enterprise Storage 5< 5.18.2-12.20.1
perl&distro=SUSE Linux Enterprise Desktop 12 SP4< 5.18.2-12.20.1
perl&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 5.18.2-12.20.1

Show all 17

Netapp4 products

Debian2 products

perl< 5.20.2-3+deb8u12 | < 5.28.1-1
debian_linuxEOL8.0 | 9.0

Alpine1 product

perl≥ 5.28.0, < 5.26.3-r0 | ≥ 5.28.0, < 5.24.4-r2

Apple1 product

mac_os_x< 10.14.4

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10

Fedoraproject1 product

fedoraEOL29

Mcafee1 product

web_gateway≥ 7.7.2, < 7.7.2.21 | ≥ 7.8.2, < 7.8.2.8 | ≥ 8.0.0, < 8.1.1

Perl1 product

perl< 5.26.3 | ≥ 5.28.0, < 5.28.1

Ubuntu1 product

perl< 5.18.2-2ubuntu1.7 | < 5.22.1-9ubuntu0.6 | < 5.26.1-6ubuntu0.3

11 vendors · 58 products

References

44 links

lists.debian.org/debian-lts-announce/2018/11/msg00039.htmlMailing ListX Refsource MLISTThird Party Advisory
www.debian.org/security/2018/dsa-4347Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/bid/106145VDB EntryX Refsource BIDThird Party Advisory
www.securitytracker.com/id/1042181VDB EntryX Refsource SECTRACKThird Party Advisory
access.redhat.com/errata/RHSA-2019:0010Vendor AdvisoryX Refsource REDHATThird Party Advisory
usn.ubuntu.com/3834-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
access.redhat.com/errata/RHSA-2019:0001Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2019:0109Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
usn.ubuntu.com/3834-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory

Show all 44 references

seclists.org/bugtraq/2019/Mar/42Mailing ListX Refsource BUGTRAQThird Party Advisory
seclists.org/fulldisclosure/2019/Mar/49Mailing ListX Refsource FULLDISCThird Party Advisory
access.redhat.com/errata/RHBA-2019:0327Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2019:1790Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2019:1942Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2019:2400Vendor AdvisoryX Refsource REDHATAdvisory
security.gentoo.org/glsa/201909-01Vendor AdvisoryX Refsource GENTOO
www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISC
www.oracle.com/security-alerts/cpujul2020.htmlX Refsource MISC
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlX Refsource MISC
support.apple.com/kb/HT209600X Refsource CONFIRMThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1646730X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT
security.netapp.com/advisory/ntap-20190221-0003/X Refsource CONFIRMThird Party Advisory
metacpan.org/changes/release/SHAY/perl-5.26.3X Refsource CONFIRMThird Party Advisory
metacpan.org/changes/release/SHAY/perl-5.28.1X Refsource CONFIRMThird Party Advisory
rt.perl.org/Ticket/Display.html?id=133204X Refsource CONFIRMIssue TrackingThird Party Advisory
github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194beX Refsource CONFIRMPatchThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10278X Refsource CONFIRMThird Party Advisory
security.alpinelinux.org/vuln/CVE-2018-18311Advisory
www.suse.com/support/update/announcement/2019/suse-su-20192264-1/Advisory
bugzilla.suse.com/1114674REPORT
www.suse.com/security/cve/CVE-2018-18311WEB
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0109.jsonAdvisory
access.redhat.com/security/cve/CVE-2018-18311REPORT
www.cve.org/CVERecord?id=CVE-2018-18311AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2018-18311Advisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1790.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1942.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2400.jsonAdvisory
ubuntu.com/security/CVE-2018-18311REPORT
ubuntu.com/security/notices/USN-3834-1Advisory
ubuntu.com/security/notices/USN-3834-2Advisory
security-tracker.debian.org/tracker/CVE-2018-18311Advisory