CVE-2018-6918

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count the size of the option header itself, causing an infinite loop when the length is zero. This issue can allow a remote attacker who is able to send an arbitrary packet to cause the machine to crash.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
FreeBSD	FreeBSD	All supported versions of FreeBSD.

References

http://seclists.org/fulldisclosure/2019/Jun/6
http://www.securityfocus.com/bid/103666Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040628Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/May/77
https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.ascVendor Advisory
https://support.apple.com/kb/HT210090
https://support.apple.com/kb/HT210091
http://seclists.org/fulldisclosure/2019/Jun/6
http://www.securityfocus.com/bid/103666Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040628Third Party Advisory, VDB Entry
https://seclists.org/bugtraq/2019/May/77
https://security.FreeBSD.org/advisories/FreeBSD-SA-18:05.ipsec.ascVendor Advisory
https://support.apple.com/kb/HT210090
https://support.apple.com/kb/HT210091

Timeline

Published: Apr 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-69197.5In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, due to insufficient initialization of mem CVE-2018-69205.5In FreeBSD before 11.1-STABLE(r332303), 11.1-RELEASE-p10, 10.4-STABLE(r332321), and 10.4-RELEASE-p9, due to insufficient initialization of m CVE-2018-69215.5In FreeBSD before 11.1-STABLE(r332066) and 11.1-RELEASE-p10, due to insufficient initialization of memory copied to userland in the network CVE-2018-69225.3One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p CVE-2018-69237.5In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial of service due to ex CVE-2018-69247.1In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p3, 11.1-RELEASE-p14, 10.4-STABLE, and 10.4-RELEASE-p12, insufficient validation in the ELF head CVE-2018-69255.5In FreeBSD before 11.2-STABLE(r338986), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338985), and 10.4-RELEASE-p13, due to improper maint CVE-2018-69267.2In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterp CVE-2018-69277.8The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer CVE-2018-69289.8PHP Scripts Mall News Website Script 2.0.4 has SQL Injection via a search term.CVE-2018-69306.5A stack-based buffer over-read in the ComputeResizeImage function in the MagickCore/accelerate.c file of ImageMagick 7.0.7-22 allows a remot CVE-2018-69348.8CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.