HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2018-1171

CVSS 7.0v3.1pub. 2018-03-19upd. 2024-11-21

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DTrace DOF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-5106.

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Joyent Smartos

    OS
    Joyent
    20170803-20170803t064301z

  • Oracle Solaris

    OS
    Oracle
    1011.3
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2020-14871CRITICAL10.0⚠ KEVPL ✓same product

Oracle Solaris PAM — zdalne przejęcie systemu bez uwierzytelnienia

CVE-2013-2251CRITICAL9.8⚠ KEVPL ✓same product

Apache Struts 2: RCE przez prefiks action/redirect w parametrach

CVE-2026-46978CRITICAL10.0PL ✓same product

Auth Bypass w Oracle Solaris Remote Administration Daemon (CVSS 10.0)

CVE-2025-36038CRITICAL9.0PL ✓same product

RCE w IBM WebSphere Application Server przez niebezpieczną deserializację

CVE-2021-39085CRITICAL9.8PL ✓same product

SQL Injection w IBM Sterling B2B Integrator — nieautoryzowany dostęp do bazy danych