« Volver al listado

CVE-2019-18903

Estado: ModificadaCrítica (9.8)—

A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Opensuse — LeapSuse — Linux Enterprise Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-18903",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Server 12",
          "versions": [
            {
              "status": "affected",
              "version": "wicked",
              "lessThan": "0.6.60-2.18.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Server 15",
          "versions": [
            {
              "status": "affected",
              "version": "wicked",
              "lessThan": "0.6.60-28.26.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "openSUSE",
          "product": "Leap 15.1",
          "versions": [
            {
              "status": "affected",
              "version": "wicked",
              "lessThan": "0.6.60-lp151.2.9.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "openSUSE",
          "product": "Factory",
          "versions": [
            {
              "status": "affected",
              "version": "wicked",
              "lessThan": "0.6.62",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-03-02T17:15:18.610",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160904",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "meissner@suse.de"
    },
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1160904",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Uso de la Memoria Previamente Liberada, en wicked de SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, y Factory, permite a atacantes remotos causar una DoS o potencialmente una ejecución de código. Este problema afecta: wicked de SUSE Linux Enterprise Server 12  versiones anteriores a 0.6.60-2.18.1. wicked de SUSE Linux Enterprise Server 15 versiones anteriores a 0.6.60-28.26.1. wicked de openSUSE Leap versiones 15.1 anteriores a 0.6.60-lp151.2.9.1. wicked de openSUSE Factory versiones anteriores a 0.6.62."
    }
  ],
  "lastModified": "2026-06-17T02:25:33.380",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F922115C-1907-4F65-9F23-3E63A8BCD4A7"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70A029CD-2AC4-4877-B1A4-5C72B351BA27"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "meissner@suse.de"
}