CVEvulnerability

CVE-2018-1000127

7.5 HIGH Published 2018-03-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-03-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-190, CWE-667

Description

memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.

Affected configurations

• memcached memcached (< 1.4.37) • debian debian linux 7.0 • debian debian linux 8.0 • debian debian linux 9.0 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 17.10 • redhat openstack 10

Related

Weakness · CWE (2)

  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-667 Improper Locking weakness

References