kritik
CVE-2018-18751
gettext: double free in default_add_message in read-catalog.c
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.0CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Julia9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Julia, Photon OS. Daha düşük diyenler: Ubuntu (orta), Red Hat (düşük), AlmaLinux (düşük), Amazon (düşük), Oracle (düşük), Rocky Linux (düşük).
Açıklama
An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Gettext_jll | 0.20.1+1 |
| Photon OS 1.0 | gettext | 0.19.5.1-4.ph1 |
| Photon OS 2.0 | gettext | 0.19.8.1-1.ph2 |
| Photon OS 3.0 | gettext | 0.19.8.1-3.ph3 |
| alma 8 | gettext, gettext-common-devel, gettext-devel ve 1 tane daha | 0.19.8.1-17.el8 |
| alpine 3.11 | gettext | 0.20.1-r0 |
| alpine 3.12 | gettext | 0.20.1-r0 |
| alpine 3.13 | gettext | 0.20.1-r0 |
| alpine 3.14 | gettext | 0.20.1-r0 |
| alpine 3.15 | gettext | 0.20.1-r0 |
| alpine 3.16 | gettext | 0.20.1-r0 |
| alpine 3.17 | gettext | 0.20.1-r0 |
37 kaynaktaki 58 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Gettext_jll | 0.20.1+1 |
| Photon OS 1.0 | gettext | 0.19.5.1-4.ph1 |
| Photon OS 2.0 | gettext | 0.19.8.1-1.ph2 |
| Photon OS 3.0 | gettext | 0.19.8.1-3.ph3 |
| alma 8 | gettext | 0.19.8.1-17.el8 |
| alma 8 | gettext-common-devel | 0.19.8.1-17.el8 |
| alma 8 | gettext-devel | 0.19.8.1-17.el8 |
| alma 8 | gettext-libs | 0.19.8.1-17.el8 |
| alpine 3.11 | gettext | 0.20.1-r0 |
| alpine 3.12 | gettext | 0.20.1-r0 |
| alpine 3.13 | gettext | 0.20.1-r0 |
| alpine 3.14 | gettext | 0.20.1-r0 |
| alpine 3.15 | gettext | 0.20.1-r0 |
| alpine 3.16 | gettext | 0.20.1-r0 |
| alpine 3.17 | gettext | 0.20.1-r0 |
| alpine 3.18 | gettext | 0.20.1-r0 |
| alpine 3.19 | gettext | 0.20.1-r0 |
| alpine 3.20 | gettext | 0.20.1-r0 |
| alpine 3.21 | gettext | 0.20.1-r0 |
| alpine 3.22 | gettext | 0.20.1-r0 |
| alpine 3.23 | gettext | 0.20.1-r0 |
| alpine 3.24 | gettext | 0.20.1-r0 |
| alpine edge | gettext | 0.20.1-r0 |
| amazon linux 2 | emacs-gettext | 0.19.8.1-3.amzn2 |
| amazon linux 2 | gettext | 0.19.8.1-3.amzn2 |
| amazon linux 2 | gettext-common-devel | 0.19.8.1-3.amzn2 |
| amazon linux 2 | gettext-debuginfo | 0.19.8.1-3.amzn2 |
| amazon linux 2 | gettext-devel | 0.19.8.1-3.amzn2 |
| amazon linux 2 | gettext-libs | 0.19.8.1-3.amzn2 |
| debian 11 | gettext | 0.19.8.1-9 |
| debian 12 | gettext | 0.19.8.1-9 |
| debian 13 | gettext | 0.19.8.1-9 |
| debian 14 | gettext | 0.19.8.1-9 |
| echo | gettext | 0.19.8.1-9 |
| Oracle Linux 7 | emacs-gettext | 0.19.8.1-3.el7 |
| Oracle Linux 7 | gettext | 0.19.8.1-3.el7 |
| Oracle Linux 7 | gettext-common-devel | 0.19.8.1-3.el7 |
| Oracle Linux 7 | gettext-devel | 0.19.8.1-3.el7 |
| Oracle Linux 7 | gettext-libs | 0.19.8.1-3.el7 |
| Oracle Linux 8 | gettext | 0.19.8.1-17.el8 |
| Oracle Linux 8 | gettext-common-devel | 0.19.8.1-17.el8 |
| Oracle Linux 8 | gettext-devel | 0.19.8.1-17.el8 |
| Oracle Linux 8 | gettext-libs | 0.19.8.1-17.el8 |
| Red Hat | mingw32-gettext | düzeltme belirtilmemiş |
| Red Hat | mingw32-gettext-static | düzeltme belirtilmemiş |
| Red Hat | mingw64-gettext | düzeltme belirtilmemiş |
| Red Hat | mingw64-gettext-static | düzeltme belirtilmemiş |
| rocky 8 | gettext | 0.19.8.1-17.el8 |
| rocky 8 | gettext-common-devel | 0.19.8.1-17.el8 |
| rocky 8 | gettext-devel | 0.19.8.1-17.el8 |
| rocky 8 | gettext-libs | 0.19.8.1-17.el8 |
| ubuntu 14.04 | gettext | 0.18.3.1-1ubuntu3.1 |
| ubuntu 14.04-ESM | gettext | 0.18.3.1-1ubuntu3.1 |
| ubuntu 16.04 | gettext | 0.19.7-2ubuntu3.1 |
| ubuntu 16.04-ESM | gettext | 0.19.7-2ubuntu3.1 |
| ubuntu 18.04 | gettext | 0.19.8.1-6ubuntu0.1 |
| ubuntu 18.04-ESM | gettext | 0.19.8.1-6ubuntu0.1 |
| ubuntu 18.10 | gettext | 0.19.8.1-8ubuntu0.1 |
Referanslar
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00061.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00065.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00025.html
- https://access.redhat.com/errata/RHSA-2019:3643
- https://access.redhat.com/security/cve/CVE-2018-18751
- https://bugzilla.redhat.com/show_bug.cgi?id=1647043
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18751
- https://errata.almalinux.org/8/ALSA-2019-3643.html
19 referansın hepsi
- https://errata.rockylinux.org/RLSA-2019:3643
- https://github.com/CCCCCrash/POCs/tree/master/Bin/Tools-gettext-0.19.8.1/doublefree
- https://github.com/CCCCCrash/POCs/tree/master/Bin/Tools-gettext-0.19.8.1/heapcorruption
- https://linux.oracle.com/cve/CVE-2018-18751.html
- https://linux.oracle.com/errata/ELSA-2020-1138.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-18751
- https://ubuntu.com/security/notices/USN-3815-1
- https://ubuntu.com/security/notices/USN-3815-2
- https://usn.ubuntu.com/3815-1/
- https://usn.ubuntu.com/3815-2/
- https://www.cve.org/CVERecord?id=CVE-2018-18751