CVE-2019-18903CWE-416

wicked: Use-after-free when receiving invalid DHCP6 IA_PD option

High · published March 2, 2020

CVSS v3.1
7.5
EPSS
2%
Percentile
84.0
In the wild
Unconfirmed
What it is

A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02416 · 84.0th percentile
Weakness
CWE-416 · Use After Free
Published
2020-03-02T16:45Z
EPSS history
Timeline
  • 02 MAR 16:45Z
    wicked: Use-after-free when receiving invalid DHCP6 IA_PD option
    cvelistv5