CVE-2018-17161

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-03 · updated 2026-06-17
Weakness: CWE-119

Description

In FreeBSD before 11.2-STABLE(r348229), 11.2-RELEASE-p7, 12.0-STABLE(r342228), and 12.0-RELEASE-p1, insufficient validation of network-provided data in bootpd may make it possible for a malicious attacker to craft a bootp packet which could cause a stack buffer overflow. It is possible that the buffer overflow could lead to a Denial of Service or remote code execution.

Affected products

FreeBSD: 11.2, 11.2-p2, 11.2-p3, 11.2-p4, 11.2-p5, 11.2-p6 (+1)

References

http://www.securityfocus.com/bid/106292
https://security.freebsd.org/advisories/FreeBSD-SA-18:15.bootpd.asc
http://www.securityfocus.com/bid/106292
https://security.freebsd.org/advisories/FreeBSD-SA-18:15.bootpd.asc

Get alerted when CVE-2018-17161 or the next vulnerability affects your stack