CVE-2018-10907

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers using 'alloca(3)'. An authenticated attacker could exploit this by mounting a gluster volume and sending a string longer that the fixed buffer size to cause crash or potential code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-109086.3It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafCVE-2018-10915.5In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggeCVE-2018-109103.3A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This siCVE-2018-109117.5A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaCVE-2018-109124.9keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could miCVE-2018-109136.5An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to deCVE-2018-109146.5It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a CVE-2018-109157.5A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between coCVE-2018-109166.5It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrCVE-2018-109176.5pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to lCVE-2018-109186.5A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker cCVE-2018-109196.5The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authent