What’s Vulnerable › Vulnerabilities

CVE-2019-18902: wicked: Use-after-free when receiving invalid DHCP6 client options

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-02 · updated 2026-06-17
• Weakness: CWE-416

Description

A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.

Affected products

• openSUSE Leap: 15.1
• SUSE Linux Enterprise Server: 12, 15

References

• https://bugzilla.suse.com/show_bug.cgi?id=1160903
• https://bugzilla.suse.com/show_bug.cgi?id=1160903

Get alerted when CVE-2019-18902 or the next vulnerability affects your stack