Summary
It was discovered that the procps-ng top utility incorrectly read its
configuration file from the current working directory. A local attacker
could possibly use this issue to escalate privileges. (CVE-2018-1122)
It was discovered that the procps-ng ps tool incorrectly handled memory. A
local user could possibly use this issue to cause a denial of service.
(CVE-2018-1123)
It was discovered that libprocps incorrectly handled the file2strvec()
function. A local attacker could possibly use this to execute arbitrary
code. (CVE-2018-1124)
It was discovered that the procps-ng pgrep utility incorrectly handled
memory. A local attacker could possibly use this issue to cause de denial
of service. (CVE-2018-1125)
It was discovered that procps-ng incorrectly handled memory. A local
attacker could use this issue to cause a denial of service, or possibly
execute arbitrary code. (CVE-2018-1126)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | procps | 1:3.3.9-1ubuntu2.3 |
| Ubuntu · 16.04 LTS 16.04:LTS | procps | 2:3.3.10-4ubuntu2.4 |
| Ubuntu · 18.04 LTS 18.04:LTS | procps | 2:3.3.12-3ubuntu1.1 |
Vulnerabilities 5
-
High 7.3CVE-2018-1122 Public exploit
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unse…
-
High 7.3CVE-2018-1124 Public exploit
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec…
-
Medium 4.8
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/intege…
-
Medium 4.4
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by F…
-
Low 3.9CVE-2018-1123 Public exploit
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection…