CVE-2018-10911

HIGH

glusterfs 3.12.0-3.12.13 - Integer Overflow in dic_unserialize Function

Title source: llm
STIX 2.1

Description

A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory from other locations into the stored dict value.

References (11)

Core 11
Core References
Patch, Vendor Advisory x_refsource_confirm
https://review.gluster.org/#/c/glusterfs/+/21067/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2607
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10911
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/09/msg00021.html
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2608
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3470
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2892
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3242
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201904-06
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html

Scores

CVSS v3 7.5
EPSS 0.0433
EPSS Percentile 89.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-190 CWE-200 CWE-502
Status published
Products (11)
debian/debian_linux 8.0
debian/debian_linux 9.0
gluster/glusterfs 3.12.0 - 3.12.14
opensuse/leap 15.1
redhat/enterprise_linux_desktop 6.0
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_server 6.0
redhat/enterprise_linux_server 7.0
redhat/enterprise_linux_workstation 6.0
redhat/enterprise_linux_workstation 7.0
... and 1 more
Published Sep 04, 2018
Tracked Since Feb 18, 2026