CVE-2018-15688

NameCVE-2018-15688
DescriptionA buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd. Affected releases are systemd: versions up to and including 239.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
Debian Bugs912008

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
network-manager (PTS)jessie0.9.10.0-7fixed
stretch1.6.2-3+deb9u2fixed
buster, sid1.14.4-3fixed
systemd (PTS)jessie215-17+deb8u7vulnerable
stretch232-25+deb9u6fixed
buster, sid239-11fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
network-managersource(unstable)1.14.4-2
network-managersourcejessie(not affected)
network-managersourcestretch1.6.2-3+deb9u2
systemdsource(unstable)239-11912008
systemdsourcestretch232-25+deb9u6

Notes

[jessie] - network-manager <not-affected> (vulnerable code not present)
https://bugzilla.redhat.com/show_bug.cgi?id=1639067
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1795921
https://github.com/systemd/systemd/commit/49653743f69658aeeebdb14faf1ab158f1f2cb20
systemd-networkd not enabled by default in Debian
NetworkManager: https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=01ca2053bbea09f35b958c8cc7631e15469acb79

Search for package or bug name: Reporting problems