Double free error in gettext - CVE-2018-18751

Vulnerability identifier: #VU15583

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-18751

CWE-ID: CWE-415

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to a double-free condition that exists in the default_add_messagefunction, as defined in the read-catalog.c source code file that is related to an invalid-free condition in the po_gram_parse function, in the po-gram-gen.ysource code file. A local attacker can execute the msgfmt --check command on a file that submits malicious input and cause the service to crash.

gettext
Arch Linux
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux
Opensuse
Fedora
gettext (Alpine package)
gettext (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
gettext-runtime-debuginfo-32bit
gettext-runtime-32bit
gettext-tools-debuginfo
gettext-tools
gettext-runtime-debugsource
gettext-runtime-debuginfo
gettext-runtime
gettext
IBM Qradar SIEM
EMC ESRS Policy Manager

Cybersecurity Help is currently unaware of any solutions addressing the vulnerability.

gettext (Alpine package) - update to 0.20.1-r2
gettext (Red Hat package) - addressed in versions 0.19.8.1-3.el7, 0.19.8.1-3.el7_6, 0.19.8.1-3.el7_7
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 10, 7.4.3 Fix Pack 3, 7.4.3 Fix Pack 4
gettext-runtime-debuginfo-32bit - update to 0.19.2-3.3.6
gettext-runtime-32bit - update to 0.19.2-3.3.6
gettext-tools-debuginfo - update to 0.19.2-3.3.6
gettext-tools - update to 0.19.2-3.3.6
gettext-runtime-debugsource - update to 0.19.2-3.3.6
gettext-runtime-debuginfo - update to 0.19.2-3.3.6
gettext-runtime - update to 0.19.2-3.3.6
gettext - addressed in versions 0.19.8.1-18.fc28, 0.19.8.1-18.fc29
EMC ESRS Policy Manager - update to 5.10.00.00

• https://github.com/CCCCCrash/POCs/tree/master/Bin/Tools-gettext-0.19.8.1/doublefree
• https://github.com/CCCCCrash/POCs/tree/master/Bin/Tools-gettext-0.19.8.1/heapcorruption

• Denial of service in GNU gettext
• Arch Linux update for gettext
• Red Hat update for gettext
• Red Hat Enterprise Linux 7 update for gettext
• Red Hat Enterprise Linux 7 update for gettext
• Red Hat Enterprise Linux 7 update for gettext
• Double free error in gettext (Alpine package)
• OpenSUSE Linux update for gettext-runtime
• OpenSUSE Linux update for gettext-runtime
• OpenSUSE Linux update for gettext-runtime
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM QRadar SIEM
• SUSE update for gettext-runtime
• Multiple vulnerabilities in Dell EMC Policy Manager
• Fedora 29 update for gettext
• Fedora 28 update for gettext