CVE-2018-10877

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
[UNKNOWN]	kernel	n/a

References

http://www.securityfocus.com/bid/104878
http://www.securityfocus.com/bid/106503Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2948Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10877Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00020.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/3753-1/Third Party Advisory
https://usn.ubuntu.com/3753-2/Third Party Advisory
https://usn.ubuntu.com/3754-1/Third Party Advisory
https://usn.ubuntu.com/3871-1/Third Party Advisory
https://usn.ubuntu.com/3871-3/Third Party Advisory
https://usn.ubuntu.com/3871-4/Third Party Advisory
https://usn.ubuntu.com/3871-5/Third Party Advisory
http://www.securityfocus.com/bid/104878
http://www.securityfocus.com/bid/106503Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2948Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10877Issue Tracking, Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00020.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/3753-1/Third Party Advisory
https://usn.ubuntu.com/3753-2/Third Party Advisory
https://usn.ubuntu.com/3754-1/Third Party Advisory
https://usn.ubuntu.com/3871-1/Third Party Advisory
https://usn.ubuntu.com/3871-3/Third Party Advisory
https://usn.ubuntu.com/3871-4/Third Party Advisory
https://usn.ubuntu.com/3871-5/Third Party Advisory

Timeline

Published: Jul 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-108787.8A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified CVE-2018-108797.8A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denia CVE-2018-10888.1A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also moun CVE-2018-108805.5Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in e CVE-2018-108815.5A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a den CVE-2018-108825.5A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a den CVE-2018-108835.5A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a de CVE-2018-108848.8Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker c CVE-2018-108857.5In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-netwo CVE-2018-108878.1A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in d CVE-2018-108886.5A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound CVE-2018-108895.3A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain