CVE-2018-9336
Fixed in a distro release EPSS <1%
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.
Products: openvpn, slackware_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | openvpn | 2.4.6-r0 |
| Alpine 3.11 | openvpn | 2.4.6-r0 |
| Alpine 3.12 | openvpn | 2.4.6-r0 |
| Alpine 3.13 | openvpn | 2.4.6-r0 |
| Alpine 3.14 | openvpn | 2.4.6-r0 |
| Alpine 3.15 | openvpn | 2.4.6-r0 |
| Alpine 3.16 | openvpn | 2.4.6-r0 |
| Alpine 3.17 | openvpn | 2.4.6-r0 |
| Alpine 3.18 | openvpn | 2.4.6-r0 |
| Alpine 3.19 | openvpn | 2.4.6-r0 |
| Alpine 3.20 | openvpn | 2.4.6-r0 |
| Alpine 3.21 | openvpn | 2.4.6-r0 |
| Alpine 3.22 | openvpn | 2.4.6-r0 |
| Alpine 3.23 | openvpn | 2.4.6-r0 |
| Alpine 3.24 | openvpn | 2.4.6-r0 |
| SUSE Linux Enterprise Module for Basesystem 15 | openvpn | 2.4.3-5.3.19 |
| openSUSE Tumbleweed | openvpn | 2.5.3-1.2 |