Explain the CVE ID: What does the identifier CVE-2018-1058 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1058.

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected.


Provide references for further information: Can you share references or external links related to CVE-2018-1058?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1547044'}, {'name': 'USN-3589-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3589-1/'}, {'name': '103221', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103221'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.postgresql.org/about/news/1834/'}, {'name': 'RHSA-2018:2511', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2511'}, {'name': 'RHSA-2018:2566', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2566'}, {'name': 'RHSA-2018:3816', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3816'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1058?


Explain the CVE ID: What does the identifier CVE-2018-1059 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1059.

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.


Provide references for further information: Can you share references or external links related to CVE-2018-1059?

{'name': 'RHSA-2018:2524', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2524'}, {'name': 'RHSA-2018:2102', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2102'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2018-1059'}, {'name': 'USN-3642-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3642-2/'}, {'name': 'RHSA-2018:2038', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2038'}, {'name': 'USN-3642-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3642-1/'}, {'name': 'RHSA-2018:1267', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1267'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1544298'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1059?


Explain the CVE ID: What does the identifier CVE-2018-1060 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1060.

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.


Provide references for further information: Can you share references or external links related to CVE-2018-1060?

{'name': 'DSA-4306', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4306'}, {'name': '1042001', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042001'}, {'name': '[debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.python.org/issue32981'}, {'name': 'USN-3817-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3817-2/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1'}, {'name': 'RHSA-2018:3505', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3505'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060'}, {'name': 'RHSA-2018:3041', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3041'}, {'name': 'DSA-4307', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4307'}, {'name': 'USN-3817-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3817-1/'}, {'name': '[debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html'}, {'name': 'FEDORA-2019-6e1938a3c5', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/'}, {'name': 'FEDORA-2019-cf725dd20b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/'}, {'name': 'FEDORA-2019-51f1e08207', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/'}, {'name': 'RHBA-2019:0327', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHBA-2019:0327'}, {'name': 'RHSA-2019:1260', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:1260'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us'}, {'name': 'RHSA-2019:3725', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3725'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'name': 'openSUSE-SU-2020:0086', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1060?


Explain the CVE ID: What does the identifier CVE-2018-1061 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1061.

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.


Provide references for further information: Can you share references or external links related to CVE-2018-1061?

{'name': 'DSA-4306', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4306'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061'}, {'name': '1042001', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042001'}, {'name': '[debian-lts-announce] 20180926 [SECURITY] [DLA 1520-1] python3.4 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.python.org/issue32981'}, {'name': 'USN-3817-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3817-2/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1'}, {'name': 'RHSA-2018:3505', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3505'}, {'name': 'RHSA-2018:3041', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3041'}, {'name': 'DSA-4307', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4307'}, {'name': 'USN-3817-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3817-1/'}, {'name': '[debian-lts-announce] 20180925 [SECURITY] [DLA 1519-1] python2.7 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html'}, {'name': 'FEDORA-2019-6e1938a3c5', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/'}, {'name': 'FEDORA-2019-cf725dd20b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/'}, {'name': 'FEDORA-2019-51f1e08207', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/'}, {'name': 'RHBA-2019:0327', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHBA-2019:0327'}, {'name': 'RHSA-2019:1260', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:1260'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03951en_us'}, {'name': 'RHSA-2019:3725', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:3725'}, {'name': 'openSUSE-SU-2020:0086', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1061?


Explain the CVE ID: What does the identifier CVE-2018-1062 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1062.

A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.


Provide references for further information: Can you share references or external links related to CVE-2018-1062?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1549944'}, {'name': 'RHBA-2018:0135', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHBA-2018:0135'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gerrit.ovirt.org/#/c/84875/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gerrit.ovirt.org/#/c/84861/'}, {'name': '103433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103433'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1062?


Explain the CVE ID: What does the identifier CVE-2018-1063 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1063.

Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the relabeling process is done, usually when taking SELinux state from disabled to enable (permissive or enforcing). The issue was found in policycoreutils 2.5-11.


Provide references for further information: Can you share references or external links related to CVE-2018-1063?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1550122'}, {'name': 'RHSA-2018:0913', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:0913'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1063?


Explain the CVE ID: What does the identifier CVE-2018-1064 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1064.

libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.


Provide references for further information: Can you share references or external links related to CVE-2018-1064?

{'name': 'USN-3680-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3680-1/'}, {'name': 'RHSA-2018:1396', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1396'}, {'name': 'DSA-4137', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4137'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=fbf31e1a4cd19d6f6e33e0937a009775cd7d9513'}, {'name': 'RHSA-2018:1929', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1929'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1550672'}, {'name': '[debian-lts-announce] 20180324 [SECURITY] [DLA 1315-1] libvirt security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/03/msg00018.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1064?


Explain the CVE ID: What does the identifier CVE-2018-1065 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1065.

The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.


Provide references for further information: Can you share references or external links related to CVE-2018-1065?

{'name': '1040446', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040446'}, {'name': 'USN-3654-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3654-1/'}, {'name': 'DSA-4188', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4188'}, {'name': 'RHSA-2018:2948', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2948'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1547824'}, {'name': 'USN-3654-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3654-2/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.openwall.net/netdev/2018/01/27/46'}, {'name': 'USN-3656-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3656-1/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://patchwork.ozlabs.org/patch/870355/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/torvalds/linux/commit/57ebd808a97d7c5b1e1afb937c2db22beba3c1f8'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7c5b1e1afb937c2db22beba3c1f8'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1065?


Explain the CVE ID: What does the identifier CVE-2018-1066 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1066.

The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.


Provide references for further information: Can you share references or external links related to CVE-2018-1066?

{'name': '[debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html'}, {'name': 'DSA-4187', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4187'}, {'name': '[debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/torvalds/linux/commit/cabfb3680f78981d26c078a26e5c748531257ebb'}, {'name': 'DSA-4188', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4188'}, {'name': 'USN-3880-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3880-1/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1539599'}, {'name': 'USN-3880-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3880-2/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cabfb3680f78981d26c078a26e5c748531257ebb'}, {'tags': ['x_refsource_MISC'], 'url': 'https://patchwork.kernel.org/patch/10187633/'}, {'name': '103378', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103378'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1066?


Explain the CVE ID: What does the identifier CVE-2018-1067 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1067.

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.


Provide references for further information: Can you share references or external links related to CVE-2018-1067?

{'name': 'RHSA-2018:1248', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1248'}, {'name': 'RHSA-2018:1251', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1251'}, {'name': 'RHSA-2018:2643', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2643'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1067'}, {'name': 'RHSA-2018:1247', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1247'}, {'name': 'RHSA-2018:1249', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1249'}, {'name': 'RHSA-2019:0877', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:0877'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1067?


Explain the CVE ID: What does the identifier CVE-2018-1068 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1068.

A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.


Provide references for further information: Can you share references or external links related to CVE-2018-1068?

{'name': 'DSA-4187', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4187'}, {'name': 'USN-3654-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3654-1/'}, {'name': 'USN-3674-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3674-1/'}, {'name': 'USN-3677-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3677-1/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1552048'}, {'name': 'DSA-4188', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4188'}, {'name': '[linux-netdev] 20180305 BUG: unable to handle kernel paging request in compat_copy_entries', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://marc.info/?l=linux-netdev&m=152023808817590&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b71812168571fa55e44cdd0254471331b9c4c4c6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/b71812168571fa55e44cdd0254471331b9c4c4c6'}, {'name': 'USN-3674-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3674-2/'}, {'name': 'RHSA-2018:1355', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1355'}, {'name': 'RHSA-2018:2948', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2948'}, {'name': '103459', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103459'}, {'name': 'RHSA-2018:1318', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1318'}, {'name': 'USN-3677-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3677-2/'}, {'name': 'USN-3654-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3654-2/'}, {'name': '[linux-netdev] 20180305 [PATCH net] netfilter: check for out-of-bounds while copying compat entries', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://marc.info/?l=linux-netdev&m=152025888924151&w=2'}, {'name': '[debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html'}, {'name': 'USN-3656-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3656-1/'}, {'name': 'RHSA-2019:1170', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:1170'}, {'name': 'RHSA-2019:1190', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:1190'}, {'name': 'RHSA-2019:4159', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:4159'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1068?


Explain the CVE ID: What does the identifier CVE-2018-1069 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1069.

Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and GroupId for GlusterFS and NFS to read and write any data on the network filesystem.


Provide references for further information: Can you share references or external links related to CVE-2018-1069?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1552987'}, {'name': '103364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103364'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1069?


Explain the CVE ID: What does the identifier CVE-2018-1070 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1070.

routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard.


Provide references for further information: Can you share references or external links related to CVE-2018-1070?

{'name': 'RHSA-2018:2013', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2013'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1070'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1070?


Explain the CVE ID: What does the identifier CVE-2018-1071 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1071.

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.


Provide references for further information: Can you share references or external links related to CVE-2018-1071?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1553531'}, {'name': 'USN-3608-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3608-1/'}, {'name': '103359', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103359'}, {'name': 'GLSA-201805-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201805-10'}, {'name': '[debian-lts-announce] 20180331 [SECURITY] [DLA 1335-1] zsh security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html'}, {'name': 'RHSA-2018:3073', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3073'}, {'name': '[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1071?


Explain the CVE ID: What does the identifier CVE-2018-1072 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1072.

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.


Provide references for further information: Can you share references or external links related to CVE-2018-1072?

{'name': 'RHSA-2018:2071', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2071'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1072'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1072?


Explain the CVE ID: What does the identifier CVE-2018-1073 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1073.

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.


Provide references for further information: Can you share references or external links related to CVE-2018-1073?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1073'}, {'name': '104189', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104189'}, {'name': 'RHSA-2018:1525', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1525'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1073?


Explain the CVE ID: What does the identifier CVE-2018-1074 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1074.

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.


Provide references for further information: Can you share references or external links related to CVE-2018-1074?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1074'}, {'name': 'RHBA-2018:1219', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHBA-2018:1219'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1074?


Explain the CVE ID: What does the identifier CVE-2018-1075 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1075.

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.


Provide references for further information: Can you share references or external links related to CVE-2018-1075?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1075'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gerrit.ovirt.org/#/c/91653/'}, {'name': 'RHSA-2018:2071', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2071'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1075?


Explain the CVE ID: What does the identifier CVE-2018-1076 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1076.


Provide references for further information: Can you share references or external links related to CVE-2018-1076?


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1076?


Explain the CVE ID: What does the identifier CVE-2018-1077 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1077.

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.


Provide references for further information: Can you share references or external links related to CVE-2018-1077?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1555429'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1077?


Explain the CVE ID: What does the identifier CVE-2018-1078 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1078.

OpenDayLight version Carbon SR3 and earlier contain a vulnerability during node reconciliation that can result in traffic flows that should be expired or should expire shortly being re-installed and their timers reset resulting in traffic being allowed that should be expired.


Provide references for further information: Can you share references or external links related to CVE-2018-1078?

{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1533501'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jira.opendaylight.org/browse/OPNFLWPLUG-971'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1078?


Explain the CVE ID: What does the identifier CVE-2018-1079 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1079.

pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.


Provide references for further information: Can you share references or external links related to CVE-2018-1079?

{'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1060'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1079'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1079?


Explain the CVE ID: What does the identifier CVE-2018-1080 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1080.

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.


Provide references for further information: Can you share references or external links related to CVE-2018-1080?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://pagure.io/freeipa/issue/7453'}, {'name': 'RHSA-2018:1979', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1979'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.gerrithub.io/c/dogtagpki/pki/+/404435'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1080'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1080?


Explain the CVE ID: What does the identifier CVE-2018-1081 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1081.

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.


Provide references for further information: Can you share references or external links related to CVE-2018-1081?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=367938'}, {'name': '103728', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103728'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1081?


Explain the CVE ID: What does the identifier CVE-2018-1082 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1082.

A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.


Provide references for further information: Can you share references or external links related to CVE-2018-1082?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-60101'}, {'name': '103725', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103725'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=367939'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1082?


Explain the CVE ID: What does the identifier CVE-2018-1083 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1083.

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.


Provide references for further information: Can you share references or external links related to CVE-2018-1083?

{'name': 'USN-3608-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3608-1/'}, {'name': '103572', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103572'}, {'name': 'GLSA-201805-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201805-10'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7'}, {'name': 'RHSA-2018:1932', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1932'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1557382'}, {'name': '[debian-lts-announce] 20180331 [SECURITY] [DLA 1335-1] zsh security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html'}, {'name': 'RHSA-2018:3073', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3073'}, {'name': '[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1083?


Explain the CVE ID: What does the identifier CVE-2018-1084 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1084.

corosync before version 2.4.4 is vulnerable to an integer overflow in exec/totemcrypto.c.


Provide references for further information: Can you share references or external links related to CVE-2018-1084?

{'name': '103758', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/103758'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1084'}, {'name': 'DSA-4174', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4174'}, {'name': 'RHSA-2018:1169', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1169'}, {'name': 'USN-4000-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/4000-1/'}, {'name': 'GLSA-202107-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202107-01'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1084?


Explain the CVE ID: What does the identifier CVE-2018-1085 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1085.

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker could use this flaw to read and modify all the data about the Openshift cluster in the etcd datastore, potentially adding another compute node, or bringing down the entire cluster.


Provide references for further information: Can you share references or external links related to CVE-2018-1085?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1085'}, {'name': 'RHSA-2018:2013', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2013'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1085?


Explain the CVE ID: What does the identifier CVE-2018-1086 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1086.

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.


Provide references for further information: Can you share references or external links related to CVE-2018-1086?

{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1086'}, {'name': 'RHSA-2018:1060', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1060'}, {'name': 'RHSA-2018:1927', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1927'}, {'name': 'DSA-4169', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4169'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1086?


Explain the CVE ID: What does the identifier CVE-2018-1087 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1087.

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.


Provide references for further information: Can you share references or external links related to CVE-2018-1087?

{'name': 'RHSA-2018:1347', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1347'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1087'}, {'name': '1040862', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040862'}, {'name': 'RHSA-2018:1348', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1348'}, {'name': 'DSA-4196', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4196'}, {'name': 'RHSA-2018:1355', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1355'}, {'name': 'RHSA-2018:1345', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1345'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/vulnerabilities/pop_ss'}, {'name': 'RHSA-2018:1318', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1318'}, {'name': 'RHSA-2018:1524', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1524'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2018/05/08/5'}, {'name': '104127', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104127'}, {'name': 'USN-3641-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3641-2/'}, {'name': 'USN-3641-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3641-1/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1087?


Explain the CVE ID: What does the identifier CVE-2018-1088 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1088.

A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.


Provide references for further information: Can you share references or external links related to CVE-2018-1088?

{'name': 'RHSA-2018:1137', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1137'}, {'name': 'RHSA-2018:1275', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1275'}, {'name': 'RHSA-2018:1524', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1524'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1558721'}, {'name': 'RHSA-2018:1136', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1136'}, {'name': 'GLSA-201904-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201904-06'}, {'name': 'openSUSE-SU-2020:0079', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html'}, {'name': '[debian-lts-announce] 20211101 [SECURITY] [DLA 2806-1] glusterfs security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1088?


Explain the CVE ID: What does the identifier CVE-2018-1089 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1089.

389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.


Provide references for further information: Can you share references or external links related to CVE-2018-1089?

{'name': '104137', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104137'}, {'name': 'RHSA-2018:1364', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1364'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1089'}, {'name': 'RHSA-2018:1380', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1380'}, {'name': '[debian-lts-announce] 20180715 [SECURITY] [DLA 1428-1] 389-ds-base security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00018.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1089?


Explain the CVE ID: What does the identifier CVE-2018-1090 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1090.

In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.


Provide references for further information: Can you share references or external links related to CVE-2018-1090?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://pulp.plan.io/issues/3521'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1090'}, {'name': 'RHSA-2018:2927', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2927'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1090?


Explain the CVE ID: What does the identifier CVE-2018-1091 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1091.

In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.


Provide references for further information: Can you share references or external links related to CVE-2018-1091?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1558149'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://marc.info/?l=linuxppc-embedded&m=150535531910494&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://access.redhat.com/security/cve/cve-2018-1091'}, {'name': 'RHSA-2018:1318', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1318'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c1fa0768a8713b135848f78fd43ffc208d8ded70'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/c1fa0768a8713b135848f78fd43ffc208d8ded70'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://openwall.com/lists/oss-security/2018/03/27/4'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1091?


Explain the CVE ID: What does the identifier CVE-2018-1092 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1092.

The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a root directory with a zero i_links_count, which allows attackers to cause a denial of service (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image.


Provide references for further information: Can you share references or external links related to CVE-2018-1092?

{'name': 'USN-3676-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3676-1/'}, {'name': 'USN-3678-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3678-2/'}, {'name': 'RHSA-2018:3083', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3083'}, {'tags': ['x_refsource_MISC'], 'url': 'http://openwall.com/lists/oss-security/2018/03/29/1'}, {'name': 'DSA-4187', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4187'}, {'name': 'USN-3678-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3678-1/'}, {'name': 'USN-3677-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3677-1/'}, {'name': 'DSA-4188', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4188'}, {'name': 'USN-3754-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3754-1/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.kernel.org/show_bug.cgi?id=199179'}, {'name': 'RHSA-2018:2948', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2948'}, {'name': 'USN-3678-3', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3678-3/'}, {'name': 'USN-3677-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3677-2/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1560777'}, {'name': 'USN-3676-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3676-2/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=8e4b5eae5decd9dfe5a4ee369c22028f90ab4c44'}, {'name': '[debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html'}, {'name': 'RHSA-2018:3096', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3096'}, {'name': 'USN-3678-4', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3678-4/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.kernel.org/show_bug.cgi?id=199275'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1092?


Explain the CVE ID: What does the identifier CVE-2018-1093 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1093.

The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image because balloc.c and ialloc.c do not validate bitmap block numbers.


Provide references for further information: Can you share references or external links related to CVE-2018-1093?

{'name': 'USN-3752-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3752-2/'}, {'name': 'USN-3676-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3676-1/'}, {'name': '[debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://openwall.com/lists/oss-security/2018/03/29/1'}, {'name': 'USN-3752-3', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3752-3/'}, {'name': '[debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html'}, {'name': '[debian-lts-announce] 20180601 [SECURITY] [DLA 1392-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.kernel.org/show_bug.cgi?id=199181'}, {'name': 'DSA-4188', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4188'}, {'name': 'USN-3754-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3754-1/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=7dac4a1726a9c64a517d595c40e95e2d0d135f6f'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1560782'}, {'name': 'USN-3676-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3676-2/'}, {'name': 'USN-3752-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3752-1/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1093?


Explain the CVE ID: What does the identifier CVE-2018-1094 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1094.

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.


Provide references for further information: Can you share references or external links related to CVE-2018-1094?

{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1560788'}, {'name': 'RHSA-2018:3083', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3083'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=18db4b4e6fc31eda838dd1c1296d67dbcb3dc957'}, {'tags': ['x_refsource_MISC'], 'url': 'http://openwall.com/lists/oss-security/2018/03/29/1'}, {'name': 'USN-3695-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3695-1/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=a45403b51582a87872927a3e0fc0a389c26867f1'}, {'name': 'USN-3695-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3695-2/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.kernel.org/show_bug.cgi?id=199183'}, {'name': 'RHSA-2018:2948', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2948'}, {'name': 'RHSA-2018:3096', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3096'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1094?


Explain the CVE ID: What does the identifier CVE-2018-1095 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1095.

The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image.


Provide references for further information: Can you share references or external links related to CVE-2018-1095?

{'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=ce3fd194fcc6fbdc00ce095a852f22df97baa401'}, {'tags': ['x_refsource_MISC'], 'url': 'http://openwall.com/lists/oss-security/2018/03/29/1'}, {'name': 'USN-3695-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3695-1/'}, {'name': 'USN-3695-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3695-2/'}, {'name': 'RHSA-2018:2948', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2948'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.kernel.org/show_bug.cgi?id=199185'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1560793'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1095?


Explain the CVE ID: What does the identifier CVE-2018-1096 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1096.

An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.


Provide references for further information: Can you share references or external links related to CVE-2018-1096?

{'name': 'RHSA-2018:2927', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2927'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1561061'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://projects.theforeman.org/issues/23028'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1096?


Explain the CVE ID: What does the identifier CVE-2018-1097 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1097.

A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.


Provide references for further information: Can you share references or external links related to CVE-2018-1097?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/theforeman/foreman/pull/5369'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1561723'}, {'name': 'RHSA-2018:2927', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2927'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://projects.theforeman.org/issues/22546'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1097?


Explain the CVE ID: What does the identifier CVE-2018-1098 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1098.

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.


Provide references for further information: Can you share references or external links related to CVE-2018-1098?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1552714'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/coreos/etcd/issues/9353'}, {'name': 'FEDORA-2019-833466697f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/'}, {'name': 'FEDORA-2019-219b0b0b6a', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1098?


Explain the CVE ID: What does the identifier CVE-2018-1099 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1099.

DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).


Provide references for further information: Can you share references or external links related to CVE-2018-1099?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1552717'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/coreos/etcd/issues/9353'}, {'name': 'FEDORA-2019-833466697f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPGYHMSKDPW5GAMI7BEP3XQRVRLLBJKS/'}, {'name': 'FEDORA-2019-219b0b0b6a', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JX7QTIT465BQGRGNCE74RATRQLKT2QE4/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1099?


Explain the CVE ID: What does the identifier CVE-2018-1100 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1100.

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.


Provide references for further information: Can you share references or external links related to CVE-2018-1100?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://sourceforge.net/p/zsh/code/ci/31f72205630687c1cef89347863aab355296a27f/'}, {'name': 'USN-3764-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3764-1/'}, {'name': 'GLSA-201805-10', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201805-10'}, {'name': 'RHSA-2018:1932', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1932'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1563395'}, {'name': 'RHSA-2018:3073', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3073'}, {'name': '[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1100?


Explain the CVE ID: What does the identifier CVE-2018-1101 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1101.

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.


Provide references for further information: Can you share references or external links related to CVE-2018-1101?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ansible.com/security'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1563492'}, {'name': 'RHSA-2018:1972', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1972'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2018-1101'}, {'name': 'RHSA-2018:1328', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1328'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1101?


Explain the CVE ID: What does the identifier CVE-2018-1102 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1102.

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.


Provide references for further information: Can you share references or external links related to CVE-2018-1102?

{'name': 'RHSA-2018:1235', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1235'}, {'name': 'RHSA-2018:1241', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1241'}, {'name': 'RHSA-2018:1233', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1233'}, {'name': 'RHSA-2019:0036', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:0036'}, {'name': 'RHSA-2018:1237', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1237'}, {'name': 'RHSA-2018:1227', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1227'}, {'name': 'RHSA-2018:1243', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1243'}, {'name': 'RHSA-2018:1231', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1231'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1562246'}, {'name': 'RHSA-2018:1229', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1229'}, {'name': 'RHSA-2018:1239', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1239'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1102?


Explain the CVE ID: What does the identifier CVE-2018-1103 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1103.

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command.


Provide references for further information: Can you share references or external links related to CVE-2018-1103?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1103'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1103?


Explain the CVE ID: What does the identifier CVE-2018-1104 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1104.

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.


Provide references for further information: Can you share references or external links related to CVE-2018-1104?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ansible.com/security'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1565862'}, {'name': 'RHSA-2018:1972', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1972'}, {'name': 'RHSA-2018:1328', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1328'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2018-1104'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1104?


Explain the CVE ID: What does the identifier CVE-2018-1105 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1105.


Provide references for further information: Can you share references or external links related to CVE-2018-1105?


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1105?


Explain the CVE ID: What does the identifier CVE-2018-1106 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1106.

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.


Provide references for further information: Can you share references or external links related to CVE-2018-1106?

{'name': 'USN-3634-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3634-1/'}, {'name': 'DSA-4207', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4207'}, {'name': '[oss-security] 20180423 Multiple local root vulnerabilities involving PackageKit CVE-2018-1106', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2018/04/23/3'}, {'name': 'RHSA-2018:1224', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1224'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1565992'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1106?


Explain the CVE ID: What does the identifier CVE-2018-1107 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1107.

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.


Provide references for further information: Can you share references or external links related to CVE-2018-1107?

{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1546357'}, {'tags': ['x_refsource_MISC'], 'url': 'https://snyk.io/vuln/npm:is-my-json-valid:20180214'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1107?


Explain the CVE ID: What does the identifier CVE-2018-1108 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1108.

kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.


Provide references for further information: Can you share references or external links related to CVE-2018-1108?

{'name': 'USN-3752-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3752-2/'}, {'name': 'USN-3752-3', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3752-3/'}, {'name': 'USN-3718-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3718-2/'}, {'name': '104055', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104055'}, {'name': 'DSA-4188', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2018/dsa-4188'}, {'name': 'USN-3718-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3718-1/'}, {'name': 'USN-3752-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3752-1/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1108'}, {'name': '[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1108?


Explain the CVE ID: What does the identifier CVE-2018-1109 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1109.

A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.


Provide references for further information: Can you share references or external links related to CVE-2018-1109?

{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1547272'}, {'tags': ['x_refsource_MISC'], 'url': 'https://snyk.io/vuln/npm:braces:20180219'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1109?


Explain the CVE ID: What does the identifier CVE-2018-1110 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1110.

A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service.


Provide references for further information: Can you share references or external links related to CVE-2018-1110?

{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1944328'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.knot-resolver.cz/2018-04-23-knot-resolver-2.3.0.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1110?


Explain the CVE ID: What does the identifier CVE-2018-1111 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1111.

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.


Provide references for further information: Can you share references or external links related to CVE-2018-1111?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1111'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2018-10'}, {'name': 'FEDORA-2018-5392896132', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDJA4QRR74TMXW34Q3DYYFPVBYRTJBI7/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://access.redhat.com/security/vulnerabilities/3442151'}, {'name': '104195', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104195'}, {'name': 'FEDORA-2018-23ca7a6798', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMTTB54QNTPD2SK6UL32EVQHMZP6BUUD/'}, {'name': '1040912', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1040912'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0'}, {'name': 'RHSA-2018:1454', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1454'}, {'name': 'RHSA-2018:1455', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1455'}, {'name': 'RHSA-2018:1457', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1457'}, {'name': 'RHSA-2018:1459', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1459'}, {'name': 'RHSA-2018:1453', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1453'}, {'name': 'FEDORA-2018-36058ed9f2', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDCLLCHYFFXW354HMB5QBXOQOY5BH2EJ/'}, {'name': 'RHSA-2018:1524', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1524'}, {'name': 'RHSA-2018:1456', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1456'}, {'name': 'RHSA-2018:1461', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1461'}, {'name': '44652', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44652/'}, {'name': '44890', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44890/'}, {'name': 'RHSA-2018:1458', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1458'}, {'name': 'RHSA-2018:1460', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1460'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1111?


Explain the CVE ID: What does the identifier CVE-2018-1112 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1112.

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.


Provide references for further information: Can you share references or external links related to CVE-2018-1112?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1112'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.gluster.org/#/c/19899/1..2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://access.redhat.com/articles/3422521'}, {'name': 'RHSA-2018:1268', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1268'}, {'name': 'RHSA-2018:1269', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1269'}, {'name': 'openSUSE-SU-2020:0079', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1112?


Explain the CVE ID: What does the identifier CVE-2018-1113 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1113.

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.


Provide references for further information: Can you share references or external links related to CVE-2018-1113?

{'name': 'RHSA-2018:3249', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3249'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1113'}, {'name': 'RHBA-2019:0327', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHBA-2019:0327'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1113?


Explain the CVE ID: What does the identifier CVE-2018-1114 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1114.

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.


Provide references for further information: Can you share references or external links related to CVE-2018-1114?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1114'}, {'name': 'RHSA-2018:2669', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2669'}, {'name': 'RHSA-2018:2643', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2643'}, {'tags': ['x_refsource_MISC'], 'url': 'https://issues.jboss.org/browse/UNDERTOW-1338'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.openjdk.java.net/browse/JDK-6956385'}, {'name': 'RHSA-2019:0877', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2019:0877'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1114?


Explain the CVE ID: What does the identifier CVE-2018-1115 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1115.

postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to connect to it could exploit this to force log rotation.


Provide references for further information: Can you share references or external links related to CVE-2018-1115?

{'name': 'GLSA-201810-08', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201810-08'}, {'name': 'RHSA-2018:2566', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2566'}, {'name': 'RHSA-2018:2565', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2565'}, {'name': '104285', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104285'}, {'name': 'openSUSE-SU-2020:1227', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1115'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=7b34740'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1115?


Explain the CVE ID: What does the identifier CVE-2018-1116 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1116.

A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.


Provide references for further information: Can you share references or external links related to CVE-2018-1116?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1116'}, {'name': 'USN-3717-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3717-2/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cgit.freedesktop.org/polkit/commit/?id=bc7ffad5364'}, {'name': '[debian-lts-announce] 20180728 [SECURITY] [DLA-1448-1] policykit-1 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00042.html'}, {'name': 'GLSA-201908-14', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201908-14'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1116?


Explain the CVE ID: What does the identifier CVE-2018-1117 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1117.

ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.


Provide references for further information: Can you share references or external links related to CVE-2018-1117?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1117'}, {'name': '104186', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104186'}, {'name': 'RHSA-2018:1452', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:1452'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1117?


Explain the CVE ID: What does the identifier CVE-2018-1118 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1118.

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.


Provide references for further information: Can you share references or external links related to CVE-2018-1118?

{'name': 'RHSA-2018:3083', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3083'}, {'name': 'USN-3762-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3762-1/'}, {'name': '[debian-lts-announce] 20180718 [SECURITY] [DLA 1423-1] linux-4.9 new package', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html'}, {'name': 'RHSA-2018:2948', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2948'}, {'name': 'USN-3762-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3762-2/'}, {'name': 'RHSA-2018:3096', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3096'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1118'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1118?


Explain the CVE ID: What does the identifier CVE-2018-1119 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1119.


Provide references for further information: Can you share references or external links related to CVE-2018-1119?


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1119?


Explain the CVE ID: What does the identifier CVE-2018-1120 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1120.

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).


Provide references for further information: Can you share references or external links related to CVE-2018-1120?

{'name': 'USN-3752-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3752-2/'}, {'name': 'RHSA-2018:3083', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3083'}, {'name': '104229', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104229'}, {'name': 'USN-3752-3', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3752-3/'}, {'name': 'GLSA-201805-14', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201805-14'}, {'name': '44806', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44806/'}, {'name': 'USN-3910-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3910-1/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7f7ccc2ccc2e70c6054685f5e3522efa81556830'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1120'}, {'name': 'USN-3910-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3910-2/'}, {'name': '[debian-lts-announce] 20180718 [SECURITY] [DLA 1423-1] linux-4.9 new package', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html'}, {'name': 'RHSA-2018:2948', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:2948'}, {'name': '[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2018/q2/122'}, {'name': 'USN-3752-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/3752-1/'}, {'name': 'RHSA-2018:3096', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2018:3096'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1120?


Explain the CVE ID: What does the identifier CVE-2018-1121 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1121.

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.


Provide references for further information: Can you share references or external links related to CVE-2018-1121?

{'name': '44806', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/44806/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121'}, {'name': '104214', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/104214'}, {'name': '[oss-security] 20180517 Qualys Security Advisory - Procps-ng Audit Report', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2018/q2/122'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1121?


Explain the CVE ID: What does the identifier CVE-2018-1122 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1122.

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.