SB2019080619 - Red Hat update for procps-ng
Published: August 6, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2018-11224)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within the in_table_init16 function in libavcodec/aacsbr.c. A remote attacker can perform denial of service attack.
2) Command injection (CVE-ID: CVE-2018-11229)
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to command injection in Crestron Toolbox Protocol (CTP). A remote unauthenticated attacker can submit a specially crafted input and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) OS command injection (CVE-ID: CVE-2018-11228)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote unauthenticated attacker can submit a specially crafted input via a Bash shell service in Crestron Toolbox Protocol (CTP) and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Privilege escalation (CVE-ID: CVE-2018-1122)
The vulnerability allows a local attacker to gain elevated privileges on the target system.The weakness exists due to top reads its configuration file from the current working directory, without any security check, if the HOME environment variable is unset or empty. A local attacker can exploit one of several vulnerabilities in top's config_file() function, execute top in /tmp (for example) and gain elevated privileges.
Remediation
Install update from vendor's website.