Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS2-2019-1144
HistoryJan 07, 2019 - 10:07 p.m.

Important: NetworkManager

2019-01-0722:07:00
alas.aws.amazon.com
16

5.8 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.3%

JSON

Issue Overview:

It was discovered that systemd-network does not correctly keep track of a buffer size when constructing DHCPv6 packets. This flaw may lead to an integer underflow that can be used to produce an heap-based buffer overflow. A malicious host on the same network segment as the victim’s one may advertise itself as a DHCPv6 server and exploit this flaw to cause a Denial of Service or potentially gain code execution on the victim’s machine.(CVE-2018-15688)

Affected Packages:

NetworkManager

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update NetworkManager to update your system.

New Packages:

aarch64:  
    NetworkManager-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-adsl-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-bluetooth-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-team-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-wifi-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-wwan-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-ppp-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-glib-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-glib-devel-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-libnm-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-libnm-devel-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-tui-1.12.0-8.amzn2.0.2.aarch64  
    NetworkManager-debuginfo-1.12.0-8.amzn2.0.2.aarch64  
  
i686:  
    NetworkManager-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-adsl-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-bluetooth-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-team-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-wifi-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-wwan-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-ppp-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-glib-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-glib-devel-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-libnm-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-libnm-devel-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-tui-1.12.0-8.amzn2.0.2.i686  
    NetworkManager-debuginfo-1.12.0-8.amzn2.0.2.i686  
  
noarch:  
    NetworkManager-config-server-1.12.0-8.amzn2.0.2.noarch  
    NetworkManager-dispatcher-routing-rules-1.12.0-8.amzn2.0.2.noarch  
  
src:  
    NetworkManager-1.12.0-8.amzn2.0.2.src  
  
x86_64:  
    NetworkManager-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-adsl-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-bluetooth-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-team-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-wifi-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-wwan-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-ppp-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-glib-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-glib-devel-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-libnm-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-libnm-devel-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-tui-1.12.0-8.amzn2.0.2.x86_64  
    NetworkManager-debuginfo-1.12.0-8.amzn2.0.2.x86_64

Additional References

Red Hat: CVE-2018-15688

Mitre: CVE-2018-15688

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64networkmanager< 1.12.0-8.amzn2.0.2NetworkManager-1.12.0-8.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64networkmanager-adsl< 1.12.0-8.amzn2.0.2NetworkManager-adsl-1.12.0-8.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64networkmanager-bluetooth< 1.12.0-8.amzn2.0.2NetworkManager-bluetooth-1.12.0-8.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64networkmanager-team< 1.12.0-8.amzn2.0.2NetworkManager-team-1.12.0-8.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64networkmanager-wifi< 1.12.0-8.amzn2.0.2NetworkManager-wifi-1.12.0-8.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64networkmanager-wwan< 1.12.0-8.amzn2.0.2NetworkManager-wwan-1.12.0-8.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64networkmanager-ppp< 1.12.0-8.amzn2.0.2NetworkManager-ppp-1.12.0-8.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64networkmanager-glib< 1.12.0-8.amzn2.0.2NetworkManager-glib-1.12.0-8.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64networkmanager-glib-devel< 1.12.0-8.amzn2.0.2NetworkManager-glib-devel-1.12.0-8.amzn2.0.2.aarch64.rpm
Amazon Linux2aarch64networkmanager-libnm< 1.12.0-8.amzn2.0.2NetworkManager-libnm-1.12.0-8.amzn2.0.2.aarch64.rpm
Rows per page:
1-10 of 411

Related

cvelist 1
nessus 38
veracode 2
oraclelinux 3
cve 1
openvas 30
photon 3
cbl_mariner 1
ubuntucve 1
centos 2
nvd 1
altlinux 2
prion 1
redhatcve 1
ubuntu 2
fedora 11
ibm 4
osv 2
cloudfoundry 1
debiancve 1
redhat 2
suse 2
archlinux 1
gentoo 1
amazon 1
debian 1
cvelist
cvelist
CVE-2018-15688 Out-of-Bounds write in systemd-networkd dhcpv6 option handling
2018-10-25 00:00:00
nessus
nessus
Scientific Linux Security Update : NetworkManager on SL7.x x86_64 (20181127)
2018-11-28 00:00:00
Photon OS 2.0: Systemd PHSA-2018-2.0-0107
2019-02-07 00:00:00
Photon OS 1.0: Systemd PHSA-2018-1.0-0193
2019-02-07 00:00:00
veracode
veracode
Denial Of Service (DoS)
2019-01-15 09:26:47
Denial Of Service (DoS)
2018-10-29 07:43:47
oraclelinux
oraclelinux
NetworkManager security update
2018-11-27 00:00:00
systemd security update
2019-01-14 00:00:00
systemd security, bug fix, and enhancement update
2019-08-13 00:00:00
cve
cve
CVE-2018-15688
2018-10-26 14:29:00
openvas
openvas
Huawei EulerOS: Security Advisory for NetworkManager (EulerOS-SA-2019-1322)
2020-01-23 00:00:00
Fedora Update for NetworkManager FEDORA-2018-71d85bc8cd
2019-05-07 00:00:00
Huawei EulerOS: Security Advisory for NetworkManager (EulerOS-SA-2019-1119)
2020-01-23 00:00:00
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-2.0-0107
2018-11-06 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-1.0-0193
2018-11-06 00:00:00
Critical Photon OS Security Update - PHSA-2018-0193
2018-11-06 00:00:00
cbl_mariner
cbl_mariner
CVE-2018-15688 affecting package systemd 239-44
2020-09-09 06:09:21
ubuntucve
ubuntucve
CVE-2018-15688
2018-10-26 00:00:00
centos
centos
NetworkManager security update
2018-12-13 20:45:55
libgudev1, systemd security update
2019-01-15 11:38:56
nvd
nvd
CVE-2018-15688
2018-10-26 14:29:00
altlinux
altlinux
Security fix for the ALT Linux 9 package NetworkManager version 1.14.5-alt1.gitba83251bba87
2018-11-01 00:00:00
Security fix for the ALT Linux 9 package systemd version 1:239-alt3
2018-10-29 00:00:00
prion
prion
Buffer overflow
2018-10-26 14:29:00
redhatcve
redhatcve
CVE-2018-15688
2022-01-13 06:45:36
ubuntu
ubuntu
systemd vulnerability
2018-11-05 00:00:00
NetworkManager vulnerability
2018-11-05 00:00:00
fedora
fedora
[SECURITY] Fedora 28 Update: NetworkManager-1.10.12-2.fc28
2018-11-08 02:20:43
[SECURITY] Fedora 27 Update: NetworkManager-1.8.8-2.fc27
2018-11-16 03:42:02
[SECURITY] Fedora 29 Update: NetworkManager-1.12.4-2.fc29
2018-11-04 05:53:43
ibm
ibm
Security Bulletin: A vulnerability in NetworkManager affects PowerKVM
2019-03-04 05:55:02
Security Bulletin: IBM MQ Cloud Paks are vulnerable to multiple vulnerabilities in Systemd (CVE-2018-15688 CVE-2018-15687 CVE-2018-15686)
2018-12-18 13:50:01
Security Bulletin: Vulnerabiliies in systemd affect PowerKVM
2019-03-04 05:50:01
osv
osv
CVE-2018-15688
2018-10-26 14:29:00
systemd - security update
2018-11-19 00:00:00
cloudfoundry
cloudfoundry
USN-3806-1: systemd vulnerability | Cloud Foundry
2018-11-20 00:00:00
debiancve
debiancve
CVE-2018-15688
2018-10-26 14:29:00
redhat
redhat
(RHSA-2018:3665) Important: NetworkManager security update
2018-11-26 23:01:01
(RHSA-2019:0049) Important: systemd security update
2019-01-14 11:21:52
suse
suse
Security update for systemd (important)
2018-11-10 00:11:51
Security update for systemd (important)
2018-11-17 00:16:31
archlinux
archlinux
[ASA-201811-11] systemd: multiple issues
2018-11-07 00:00:00
gentoo
gentoo
systemd: Multiple vulnerabilities
2018-10-30 00:00:00
amazon
amazon
Important: systemd
2019-02-13 18:37:00
debian
debian
[SECURITY] [DLA 1580-1] systemd security update
2018-11-19 23:42:42

5.8 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.3%

JSON
Related for ALAS2-2019-1144
cvelist1nessus38veracode2oraclelinux3cve1openvas30photon3cbl_mariner1ubuntucve1centos2nvd1altlinux2prion1redhatcve1ubuntu2fedora11ibm4osv2cloudfoundry1debiancve1redhat2suse2archlinux1gentoo1amazon1debian1