Veracode Vulnerability DatabaseVERACODE:21141Privilege Escalation
0.0004 Low
EPSS
Percentile
10.1%
procps-ng is vulnerable to privilege escalation. The top utility is run with HOME unset in an attacker-controlled directory, the attacker can exploit one of several vulnerabilities in the config_file() to escalate the privileges.
| CPE | Name | Operator | Version |
|---|---|---|---|
| procps-ng | eq | 3.3.10__17.el7_5.2 | |
| procps-ng | eq | 3.3.10__23.el7 |
References
seclists.org/oss-sec/2018/q2/122
www.securityfocus.com/bid/104214
access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.7_Release_Notes/index.html
access.redhat.com/errata/RHSA-2019:2189
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=1692843
bugzilla.redhat.com/show_bug.cgi?id=1699264
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1122
lists.debian.org/debian-lts-announce/2018/05/msg00021.html
security.gentoo.org/glsa/201805-14
usn.ubuntu.com/3658-1/
usn.ubuntu.com/3658-3/
www.debian.org/security/2018/dsa-4208
www.exploit-db.com/exploits/44806/
www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt
Related
