CVE-2018-17962 Integer overflow in n/a

High 7.5 Published 9 Oct 2018 Updated 5 Aug 2024

An integer overflow in QEMU's pcnet network device allows attackers to cause buffer overflows, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-17962?

CVE-2018-17962 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 9 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.

Weakness: CWE-190, CWE-119

Which versions are affected by CVE-2018-17962?

It affects 6 products.

Products include Canonical Ubuntu Linux, Debian Debian Linux, Oracle Linux, Qemu Qemu, Redhat Linux, Suse Linux Enterprise Server.

How do I fix CVE-2018-17962?

Apply the vendor's patch.

Is CVE-2018-17962 being exploited?

There is no known exploitation of CVE-2018-17962 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-17962, GHSA-q23x-9vcw-j6c2, UBUNTU-CVE-2018-17962.