Vulnerability Details : CVE-2018-1427
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) contains several environment variables that a local attacker could overflow and cause a denial of service. IBM X-Force ID: 139072.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2018-1427
- cpe:2.3:a:ibm:db2:9.7:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:ibm:db2:10.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:ibm:db2:10.5:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:ibm:db2:11.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
Exploit prediction scoring system (EPSS) score for CVE-2018-1427
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 18 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-1427
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:N/A:P |
3.9
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST | |
|
6.2
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
2.5
|
3.6
|
IBM Corporation |
CWE ids for CVE-2018-1427
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-1427
-
http://www.securitytracker.com/id/1041012
IBM Security Network Protection GSKit Flaws Let Local Users Obtain Passwords and Other Sensitive Information and Deny Service - SecurityTrackerThird Party Advisory;VDB Entry
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/139072
IBM GSKit denial of service CVE-2018-1427 Vulnerability ReportVDB Entry;Vendor Advisory
-
http://www.securityfocus.com/bid/103536
IBM DB2 CVE-2018-1427 Multiple Local Buffer Overflow VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.ibm.com/support/docview.wss?uid=swg22013756
IBM Security Bulletin: IBM® Db2® is affected by multiple vulnerabilities in the GSKit libraryVendor Advisory
Jump to