Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2018-18751

critical

CVE-2018-18751

gettext: double free in default_add_message in read-catalog.c

Published Modified CWE 415
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.0CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Julia9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, Julia, Photon OS. Rated lower by Ubuntu (medium), Red Hat (low), AlmaLinux (low), Amazon (low), Oracle (low), Rocky Linux (low).

Description

An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.

Affected packages and fixed versions

SourcePackageFixed in
julia::Julia Ecosystem Security AdvisoriesGettext_jll0.20.1+1
Photon OS 1.0gettext0.19.5.1-4.ph1
Photon OS 2.0gettext0.19.8.1-1.ph2
Photon OS 3.0gettext0.19.8.1-3.ph3
alma 8gettext, gettext-common-devel, gettext-devel and 1 more0.19.8.1-17.el8
alpine 3.11gettext0.20.1-r0
alpine 3.12gettext0.20.1-r0
alpine 3.13gettext0.20.1-r0
alpine 3.14gettext0.20.1-r0
alpine 3.15gettext0.20.1-r0
alpine 3.16gettext0.20.1-r0
alpine 3.17gettext0.20.1-r0
Show all 58 entries from 37 sources
SourcePackageFixed in
julia::Julia Ecosystem Security AdvisoriesGettext_jll0.20.1+1
Photon OS 1.0gettext0.19.5.1-4.ph1
Photon OS 2.0gettext0.19.8.1-1.ph2
Photon OS 3.0gettext0.19.8.1-3.ph3
alma 8gettext0.19.8.1-17.el8
alma 8gettext-common-devel0.19.8.1-17.el8
alma 8gettext-devel0.19.8.1-17.el8
alma 8gettext-libs0.19.8.1-17.el8
alpine 3.11gettext0.20.1-r0
alpine 3.12gettext0.20.1-r0
alpine 3.13gettext0.20.1-r0
alpine 3.14gettext0.20.1-r0
alpine 3.15gettext0.20.1-r0
alpine 3.16gettext0.20.1-r0
alpine 3.17gettext0.20.1-r0
alpine 3.18gettext0.20.1-r0
alpine 3.19gettext0.20.1-r0
alpine 3.20gettext0.20.1-r0
alpine 3.21gettext0.20.1-r0
alpine 3.22gettext0.20.1-r0
alpine 3.23gettext0.20.1-r0
alpine 3.24gettext0.20.1-r0
alpine edgegettext0.20.1-r0
amazon linux 2emacs-gettext0.19.8.1-3.amzn2
amazon linux 2gettext0.19.8.1-3.amzn2
amazon linux 2gettext-common-devel0.19.8.1-3.amzn2
amazon linux 2gettext-debuginfo0.19.8.1-3.amzn2
amazon linux 2gettext-devel0.19.8.1-3.amzn2
amazon linux 2gettext-libs0.19.8.1-3.amzn2
debian 11gettext0.19.8.1-9
debian 12gettext0.19.8.1-9
debian 13gettext0.19.8.1-9
debian 14gettext0.19.8.1-9
echogettext0.19.8.1-9
Oracle Linux 7emacs-gettext0.19.8.1-3.el7
Oracle Linux 7gettext0.19.8.1-3.el7
Oracle Linux 7gettext-common-devel0.19.8.1-3.el7
Oracle Linux 7gettext-devel0.19.8.1-3.el7
Oracle Linux 7gettext-libs0.19.8.1-3.el7
Oracle Linux 8gettext0.19.8.1-17.el8
Oracle Linux 8gettext-common-devel0.19.8.1-17.el8
Oracle Linux 8gettext-devel0.19.8.1-17.el8
Oracle Linux 8gettext-libs0.19.8.1-17.el8
Red Hatmingw32-gettextno fix listed
Red Hatmingw32-gettext-staticno fix listed
Red Hatmingw64-gettextno fix listed
Red Hatmingw64-gettext-staticno fix listed
rocky 8gettext0.19.8.1-17.el8
rocky 8gettext-common-devel0.19.8.1-17.el8
rocky 8gettext-devel0.19.8.1-17.el8
rocky 8gettext-libs0.19.8.1-17.el8
ubuntu 14.04gettext0.18.3.1-1ubuntu3.1
ubuntu 14.04-ESMgettext0.18.3.1-1ubuntu3.1
ubuntu 16.04gettext0.19.7-2ubuntu3.1
ubuntu 16.04-ESMgettext0.19.7-2ubuntu3.1
ubuntu 18.04gettext0.19.8.1-6ubuntu0.1
ubuntu 18.04-ESMgettext0.19.8.1-6ubuntu0.1
ubuntu 18.10gettext0.19.8.1-8ubuntu0.1

References

All 19 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.