CVE-2018-5733: canonical ubuntu_linux Integer Overflow or Wraparound
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2018-5733UBUNTU-CVE-2018-5733DEBIAN-CVE-2018-5733
Published 16-01-2019Last modified 25-04-2025
Vulnerability summary
CVE-2018-5733 is a high (CVSS 7.5) Integer Overflow or Wraparound vulnerability in canonical ubuntu_linux. EPSS estimates a 20.24% chance of exploitation in the next 30 days, higher than 97.4% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
20.24%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 10 · Related 5Timeline
- 16-01-2019PublishedVulnerability first disclosed.
- 25-04-2025Last modifiedVulnerability information updated.
Description
A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0.
CVSS metrics
8 scores · 5 sources · 3 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.9Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- NVDNIST5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
20.24%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 20.24% on 18-09-2026
18-09-202618-10-2026
EPSS score20.24%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat5 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.4 | 7.6
- enterprise_linux_server_eus7.4 | 7.5 | 7.6
- enterprise_linux_workstation6.0 | 7.0
Debian2 products
- isc-dhcp< 4.3.5-3.1
- debian_linuxEOL7.0 | 8.0 | 9.0
Isc2 products
- dhcp≥ 4.2.0, ≤ 4.2.8 | ≥ 4.3.0, ≤ 4.3.6 | 4.1-esv | 4.1-esv:r1 | 4.1-esv:r10 | 4.1-esv:r10_b1 | 4.1-esv:r10_rc1 | 4.1-esv:r11 | 4.1-esv:r11_b1 | 4.1-esv:r11_rc1 | 4.1-esv:r11_rc2 | 4.1-esv:r12 | 4.1-esv:r12_b1 | 4.1-esv:r12_p1 | 4.1-esv:r13 | 4.1-esv:r13_b1 | 4.1-esv:r14 | 4.1-esv:r14_b1 | 4.1-esv:r15 | 4.1-esv:r2 | 4.1-esv:r3 | 4.1-esv:r3_b1 | 4.1-esv:r4 | 4.1-esv:r5 | 4.1-esv:r5_b1 | 4.1-esv:r5_rc1 | 4.1-esv:r5_rc2 | 4.1-esv:r6 | 4.1-esv:r7 | 4.1-esv:r8 | 4.1-esv:r8_b1 | 4.1-esv:r8_rc1 | 4.1-esv:r9 | 4.1-esv:r9_b1 | 4.1-esv:r9_rc1 | 4.1-esv:rc1 | 4.1.0 | 4.4.0
- isc dhcpISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0
Alpine1 product
- dhcp≥ 4.2.0, < 4.4.1-r0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10
Ubuntu1 product
- isc-dhcp< 4.2.4-7ubuntu12.12 | < 4.3.3-5ubuntu12.9 | < 4.3.5-3ubuntu5
6 vendors · 12 products
References
17 links
- lists.debian.org/debian-lts-announce/2018/03/msg00015.htmlMailing ListX Refsource MLISTThird Party Advisory