CVE-2018-1000517 Memory corruption in n/a
A heap buffer overflow in BusyBox wget allows remote attackers to execute arbitrary code or cause a denial of service via network connectivity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000517?
CVE-2018-1000517 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 26 Jun 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e.
Weakness: CWE-120
Which versions are affected by CVE-2018-1000517?
It affects 3 products.
Products include Busybox Busybox, Canonical Ubuntu Linux, Debian Debian Linux.
How do I fix CVE-2018-1000517?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-1000517 being exploited?
There is no known exploitation of CVE-2018-1000517 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2018-1000517, GHSA-m9j3-9rqj-pg6p, UBUNTU-CVE-2018-1000517.