CVE-2018-1000127
Fixed in a distro release EPSS 2%
memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.
Products: memcached, debian_linux, canonical ubuntu_linux, redhat openstack
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | memcached | 1.5.0-1 |
| Debian 13 | memcached | 1.5.0-1 |
| Debian 14 | memcached | 1.5.0-1 |
| Debian 7 | memcached | 1.4.13-0.2+deb7u4 |
| Debian 8 | memcached | 1.4.21-1.1+deb8u2 |
| Debian 9 | memcached | 1.4.33-1+deb9u1 |
| Red Hat openstack 10 | memcached | 0:1.4.39-2.el7ost |
| Red Hat openstack 10 | memcached-debuginfo | 0:1.4.39-2.el7ost |
| Ubuntu 14.04 LTS | memcached | 1.4.14-0ubuntu9.3 |
| Ubuntu 16.04 LTS | memcached | 1.4.25-2ubuntu1.4 |
| openSUSE Tumbleweed | memcached | 1.6.9-2.3 |