CVE-2018-0002
published 2018-01-10CVE-2018-0002: On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory…
PriorityP430medium5.9CVSS 3.0
AVNACHPRNUINSUCNINAH
EPSS
1.54%
72.2th percentile
On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in an extended Denial of Service condition. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D60 on SRX series; 12.3X48 versions prior to 12.3X48-D35 on SRX series; 14.1 versions prior to 14.1R9 on MX series; 14.2 versions prior to 14.2R8 on MX series; 15.1X49 versions prior to 15.1X49-D60 on SRX series; 15.1 versions prior to 15.1R5-S8, 15.1F6-S9, 15.1R6-S4, 15.1R7 on MX series; 16.1 versions prior to 16.1R6 on MX series; 16.2 versions prior to 16.2R3 on MX series; 17.1 versions prior to 17.1R2-S4, 17.1R3 on MX series. No other Juniper Networks products or platforms are affected by this issue.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper | mx_series | — | — |
| juniper | srx_series | — | — |
| juniper_networks | junos_os | >= 12.1X46 < 12.1X46-D60 | 12.1X46-D60 |
| juniper_networks | junos_os | >= 12.3X48 < 12.3X48-D35 | 12.3X48-D35 |
| juniper_networks | junos_os | >= 14.1 < 14.1R9 | 14.1R9 |
| juniper_networks | junos_os | >= 14.2 < 14.2R8 | 14.2R8 |
| juniper_networks | junos_os | >= 15.1 < 15.1R5-S8, 15.1F6-S9, 15.1R6-S4, 15.1R7 | 15.1R5-S8, 15.1F6-S9, 15.1R6-S4, 15.1R7 |
| juniper_networks | junos_os | >= 15.1X49 < 15.1X49-D60 | 15.1X49-D60 |
| juniper_networks | junos_os | >= 16.1 < 16.1R6 | 16.1R6 |
| juniper_networks | junos_os | >= 16.2 < 16.2R3 | 16.2R3 |
| juniper_networks | junos_os | >= 17.1 < 17.1R2-S4, 17.1R3 | 17.1R2-S4, 17.1R3 |
| mercurial | mercurial | >= 0 < 4.6.1 | 4.6.1 |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mercurial: Buffer underflow in mpatch.c:mpatch_apply()
vendor_redhat·2018-06-06·CVSS 9.8
CVE-2018-13347 [CRITICAL] CWE-20 mercurial: Buffer underflow in mpatch.c:mpatch_apply()
mercurial: Buffer underflow in mpatch.c:mpatch_apply()
mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.
Package: mercurial (Red Hat Enterprise Linux 6) - Will not fix
Package: mercurial (Red Hat Enterprise Linux 8) - Not affected
Juniper
CVE-2018-0002: On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in
vendor_juniper·2018-01-10·CVSS 8.2
CVE-2018-0002 [HIGH] CWE-119 CVE-2018-0002: On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in
CVE-2018-0002: On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in an extended Denial of Service condition. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D60 on SRX series; 12.3X48 versions prior to 12.3X48-D35 on SRX series; 14.1 versions prior to 14.1R9 on MX series; 14.2 versions prior to 14.2R8 on MX series; 15.1X49 versions prior to 15.1X49-D60 on SRX series; 15.1 versions prior to 15.1R5-S8, 15.1F6-S9, 15.1R6-S4, 15.1R7 on MX series; 16.1 versions prior to 16.1R6 on MX series; 16.2 versions prior to 16.2R3
GHSA
GHSA-w7r7-44qw-8v64: On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in
ghsa_unreviewed·2022-05-13
CVE-2018-0002 [MEDIUM] CWE-119 GHSA-w7r7-44qw-8v64: On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in
On SRX Series and MX Series devices with a Service PIC with any ALG enabled, a crafted TCP/IP response packet processed through the device results in memory corruption leading to a flowd daemon crash. Sustained crafted response packets lead to repeated crashes of the flowd daemon which results in an extended Denial of Service condition. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D60 on SRX series; 12.3X48 versions prior to 12.3X48-D35 on SRX series; 14.1 versions prior to 14.1R9 on MX series; 14.2 versions prior to 14.2R8 on MX series; 15.1X49 versions prior to 15.1X49-D60 on SRX series; 15.1 versions prior to 15.1R5-S8, 15.1F6-S9, 15.1R6-S4, 15.1R7 on MX series; 16.1 versions prior to 16.1R6 on MX series; 16.2 versions prior to 16.2R3 on MX series;
GHSA
Mercurial mishandles integer addition and subtraction
ghsa·2022-05-13
CVE-2018-13347 [CRITICAL] CWE-190 Mercurial mishandles integer addition and subtraction
Mercurial mishandles integer addition and subtraction
`mpatch.c` in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-1042 CVE-2018-1043 CVE-2018-1044 CVE-2018-1045 moodle: Four security issues fixed in the latest release
bugzilla·2018-01-23·CVSS 6.5
CVE-2018-1042 [MEDIUM] CVE-2018-1042 CVE-2018-1043 CVE-2018-1044 CVE-2018-1045 moodle: Four security issues fixed in the latest release
CVE-2018-1042 CVE-2018-1043 CVE-2018-1044 CVE-2018-1045 moodle: Four security issues fixed in the latest release
MSA-18-0001: Server Side Request Forgery in the filepicker - CVE-2018-1042
By substituting the source URL in the filepicker AJAX request authenticated users are able to retrieve and view any URL. We classify this issue as serious because some cloud hosting providers contain internal resources that can expose data and compromise a server
https://moodle.org/mod/forum/discuss.php?d=364381
MSA-18-0002: Setting for blocked hosts list can be bypassed with multiple A record hostnames - CVE-2018-1043
Moodle setting "cURL blocked hosts list" was introduced in Moodle 3.2 to prevent access to specific addresses (usually internal) when server retrieves URLs requested by the user. PoC w
Bugzilla
CVE-2017-12189 jboss: unsafe chown of server.log in jboss init script allows privilege escalation (Incomplete fix for CVE-2016-8656)
bugzilla·2017-10-09·CVSS 7.0
CVE-2017-12189 [HIGH] CVE-2017-12189 jboss: unsafe chown of server.log in jboss init script allows privilege escalation (Incomplete fix for CVE-2016-8656)
CVE-2017-12189 jboss: unsafe chown of server.log in jboss init script allows privilege escalation (Incomplete fix for CVE-2016-8656)
It was reported that the jbossas init script performed unsafe file handling, which could result in local privilege escalation.
Discussion:
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform
Via RHSA-2018:0003 https://access.redhat.com/errata/RHSA-2018:0003
---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6
Via RHSA-2018:0002 https://access.redhat.com/errata/RHSA-2018:0002
---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7
Via RHSA-2018:0004 https://access.
2018-01-10
Published