CVE-2018-18409

Medium

Description

A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an address_histogram call or a get_histogram call.

SeverityMedium

CVSS5.5

Exploit probability—

Product

Digitalcorpora Tcpflow

PublishedOct 17, 2018

First seenOct 17, 2018

How to fix

Vendor advisories

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K6MP4YMCJX4ITOBFX427UMOA6E7ZLJDE/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MN5FW6HKPDP7PI2IVNMFSQVIDSCQ5BOR/
usn.ubuntu.com/3955-1/

Affected products

Product	Affected versions	Fixed in
digitalcorpora tcpflow	1.5.0	—
fedoraproject fedora	28, 29	—
canonical ubuntu_linux	16.04, 18.04, 18.10	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.