High ELSA-2018-1700 2 CVEs

Important: procps-ng security update (Oracle Linux 7)

Published May 23, 2018 · Updated May 23, 2018

Ecosystem: Oracle Linux

Summary

[3.3.10-17.el7_5.2]
- check for truncation after calling snprintf()
- Related: CVE-2018-1124

[3.3.10-17.el7_5.1]
- fix integer overflows leading to heap overflow in file2strvec()
- Resolves: CVE-2018-1124

Fixed packages 3

Release	Package	Fixed in
Oracle Linux · 7	procps-ng	0:3.3.10-17.el7_5.2
Oracle Linux · 7	procps-ng-devel	0:3.3.10-17.el7_5.2
Oracle Linux · 7	procps-ng-i18n	0:3.3.10-17.el7_5.2

Vulnerabilities 2

High 7.3

CVE-2018-1124 Public exploit

procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec…

[UNKNOWN] procps-ng procps procps Debian Ubuntu

May 23, 2018
Medium 4.8

CVE-2018-1126

procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/intege…

[UNKNOWN] procps-ng, procps procps procps Debian Ubuntu

May 23, 2018