VDB
CVE-2018-10545
CVE-2018-10545
PUBLISHED
CVSS 4.699999809265137 MEDIUM
An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.
EPSS 0.80% · 55.1th percentile
Risk Scores
CVSS 3.0
4.699999809265137
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.80%
55.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | php7.0 | 7.0.2-5, 0, 7.0.1-5 |
| Ubuntu:18.04:LTS | php7.2 | 7.2.3-1ubuntu1, 7.2.1-1ubuntu2, 7.2.2-1ubuntu1 |
| Ubuntu:14.04:LTS | php5 | 0, 5.5.3+dfsg-1ubuntu2, 5.5.3+dfsg-1ubuntu3 |
Timeline
- Apr 29, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 28, 2021 EPSS Score
- Dec 30, 2021 EPSS Score
- Mar 3, 2022 EPSS Score
- May 5, 2022 EPSS Score
- Jul 7, 2022 EPSS Score
- Sep 10, 2022 EPSS Score
- Nov 12, 2022 EPSS Score
- Jan 14, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2018-10545 third-party-advisory
- http://php.net/ChangeLog-5.php third-party-advisory
- http://php.net/ChangeLog-7.php third-party-advisory
- https://ubuntu.com/security/notices/USN-3646-1 vendor-advisory
- https://ubuntu.com/security/notices/USN-3646-2 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2018-10545 third-party-advisory