What’s Vulnerable › Vulnerabilities

CVE-2019-18903: wicked: Use-after-free when receiving invalid DHCP6 IA_PD option

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-02 · updated 2026-06-17
• Weakness: CWE-416

Description

A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62.

Affected products

• openSUSE Leap: 15.1
• SUSE Linux Enterprise Server: 12, 15

References

• https://bugzilla.suse.com/show_bug.cgi?id=1160904
• https://bugzilla.suse.com/show_bug.cgi?id=1160904

Get alerted when CVE-2019-18903 or the next vulnerability affects your stack