CVE-2018-1124

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122CWE-190CWE-787

Affected software

VendorProductVersions
[UNKNOWN]procps-ngprocps-ng 3.3.15

References

Timeline

Published
May 23, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-112409.8An issue was discovered on SoftCase T-Router build 20112017 devices. There are no restrictions on the 'exec command' feature of the T-RouterCVE-2018-112419.8An issue was discovered on SoftCase T-Router build 20112017 devices. A remote attacker can read and write to arbitrary files on the system aCVE-2018-112426.5An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypted and have cleartextCVE-2018-112437.8PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of CVE-2018-112445.3The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor.CVE-2018-112456.1app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.CVE-2018-112467.5K7TSMngr.exe in K7Computing K7AntiVirus Premium 15.1.0.53 has a Memory Leak.CVE-2018-112479.8The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute CVE-2018-112489.8util/FileDownloadUtils.java in FileDownloader 1.7.3 does not check an attachment's name. If an attacker places "../" in the file name, the fCVE-2018-11257.5procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involveCVE-2018-112516.5In ImageMagick 7.0.7-23 Q16 x86_64 2018-01-24, there is a heap-based buffer over-read in ReadSUNImage in coders/sun.c, which allows attackerCVE-2018-112545.5An issue was discovered in PoDoFo 0.9.5. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of PdfPagesTree.cpp. Re
CVE-2018-1124: High severity, CVSS 7.8 | Vulnix