CVE-2018-10932

MEDIUM

Intel lldptool < 1.0.1 - Terminal Injection via Unsanitized mngAddr Buffer

Title source: llm
STIX 2.1

Description

lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal.

References (4)

Core 4
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10932
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1551623
Third Party Advisory, VDB Entry x_refsource_confirm
https://github.com/intel/openlldp/pull/7
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3673

Scores

CVSS v3 4.3
EPSS 0.0104
EPSS Percentile 59.3%
Attack Vector ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-119 CWE-117
Status published
Products (1)
intel/lldptool < 1.0.1
Published Aug 21, 2018
Tracked Since Feb 18, 2026