CVE-2018-1000849

HIGH

Alpine Linux <2.6.10, 2.7.6, 2.10.1 - Remote Code Execution

Title source: llm
STIX 2.1

Description

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file, due to bugs in handling long link target name and the way a regular file is extracted.. This vulnerability appears to have been fixed in 2.6.10, 2.7.6, and 2.10.1.

References (3)

Core 3
Core References
Exploit, Third Party Advisory x_refsource_misc
https://justi.cz/security/2018/09/13/alpine-apk-rce.html

Scores

CVSS v3 8.8
EPSS 0.0353
EPSS Percentile 87.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (1)
alpinelinux/alpine_linux < 2.6.10
Published Dec 20, 2018
Tracked Since Feb 18, 2026