9.8

CVE-2018-8828: debian debian_linux Off-by-one Error

CVSS: 9.8v3.0CriticalModified
AliasesALPINE-CVE-2018-8828UBUNTU-CVE-2018-8828USN-4240-1
Published 20-03-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-8828 is a critical (CVSS 9.8) Off-by-one Error vulnerability in debian debian_linux. EPSS estimates a 30.41% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.0 (NVD)
EPSS score
30.41%
0%100%
High · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 20-03-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

30.41%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 30.41% on 18-09-2026

18-09-202618-10-2026
EPSS score
30.41%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • kamailio< 5.1.2-1 | < 4.2.0-2+deb8u3 | < 4.4.4-2+deb9u1
  • debian_linuxEOL8.0 | 9.0
Alpine1 product
  • kamailio≥ 5.0.0, < 4.4.0-r2 | ≥ 5.0.0, < 4.4.5-r1 | ≥ 5.0.0, < 5.0.2-r2
Kamailio1 product
  • kamailio< 4.4.7 | ≥ 5.0.0, < 5.0.6 | ≥ 5.1.0, < 5.1.2
Ubuntu1 product
  • kamailio< 4.3.4-1.1ubuntu2.1

4 vendors · 5 products

References

9 links