procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade procps-ng-debuginfoUpgrade procps-ng-i18nUpgrade procps-ngUpgrade procps-ng-devel | Apr 27, 2020 | May 23, 2018 |
| Centos_linux | — | Upgrade procps-ng-debuginfoUpgrade procps-debuginfoUpgrade procps-develUpgrade procps-ng-i18nUpgrade procps-ng-develUpgrade procps-ngUpgrade procps | May 31, 2018 | May 23, 2018 |
| Debian | — | Upgrade procps | May 24, 2018 | May 22, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Dec 28, 2020 |
| Gentoo Linux | — | Upgrade sys-process/procps. | May 31, 2018 | May 23, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade procps-ng | Jul 3, 2018 | May 23, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade procps-ng | Jul 3, 2018 | May 23, 2018 |
| Oracle Solaris | — | Upgrade shell/watch to version 3.3.15-11.4.18.0.1.1.0 on Solaris 11.4 | Jan 19, 2021 | May 23, 2018 |
| Oracle_linux | — | Upgrade procps-ng-i18nUpgrade procpsUpgrade procps-ngUpgrade procps-ng-develUpgrade procps-devel | May 24, 2018 | May 17, 2018 |
| Redhat_linux | — | Upgrade procps-ng-i18nUpgrade procps-develUpgrade procps-debuginfoUpgrade procps-ng-debuginfoUpgrade procps-ngUpgrade procps-ng-develNo solution existsUpgrade procps | May 24, 2018 | May 23, 2018 |
| Suse | — | Upgrade procpsUpgrade libprocps3Upgrade libprocps7Upgrade procps-devel | Jun 29, 2018 | May 23, 2018 |
| Ubuntu | — | Upgrade libprocps6Upgrade procpsUpgrade libprocps3Upgrade libprocps4 | Jun 1, 2018 | May 23, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 23, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub