CVE-2018-14661

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to cause remote denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-134

Affected software

Vendor	Product	Versions
The Gluster Project	glusterfs-server	3.8.4

References

https://access.redhat.com/errata/RHSA-2018:3431Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3432Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3470Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14661Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00003.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201904-06Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3431Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3432Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3470Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14661Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00003.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201904-06Third Party Advisory

Timeline

Published: Oct 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-146625.7It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt encryption keys used CVE-2018-146635.9An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the ad CVE-2018-146645.4A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in CVE-2018-146656.6A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X CVE-2018-146667.2An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host r CVE-2018-146679.8The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unaut CVE-2018-146688.8In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which CVE-2018-146697.5ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database CVE-2018-14677.5The IBM Storwize V7000 Unified management Web interface 1.6 exposes internal cluster details to unauthenticated users. IBM X-Force ID: 14039 CVE-2018-146709.8Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.CVE-2018-146719.8In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vu CVE-2018-146725.3In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messag