CVE-2018-1000849
High
Description
Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file, due to bugs in handling long link target name and the way a regular file is extracted.. This vulnerability appears to have been fixed in 2.6.10, 2.7.6, and 2.10.1.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Alpinelinux Alpine Linux
PublishedDec 20, 2018
First seenDec 20, 2018
How to fix
Update
- alpinelinux alpine_linux2.6.10, 2.7.6, 2.10.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alpinelinux alpine_linux | v < 2.6.10, 2.7.0 ≤ v < 2.7.6, 2.7.7 ≤ v < 2.10.1 | 2.6.10, 2.7.6, 2.10.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.