VDB

CVE-2018-16866

CVE-2018-16866 PUBLISHED CVSS 4.3 MEDIUM

Reported by redhat · Published January 11, 2019

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
systemdAmazon Linux219-57.amzn2.0.7
systemd-develAmazon Linux219-57.amzn2.0.7
libgudev1-develAmazon Linux219-57.amzn2.0.7
systemdArch Linux240.0-3
systemd-pythonAmazon Linux219-57.amzn2.0.7
systemd-journal-gatewayAmazon Linux219-57.amzn2.0.7
systemdsystemd_project239
systemdUbuntu:16.04:LTS229-4ubuntu21.15

Risk scores

CVSS 3.0
4.3
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

VendorProductVersions
The systemd Projectsystemdfrom v221 to v239
amazon:2systemd0
amazon:2systemd-devel0
amazon:2libgudev1-devel0
archsystemd0
amazon:2systemd-python0
amazon:2systemd-journal-gateway0
The systemd Projectsystemd*
amazon:2systemd-resolved0
amazon:2libgudev10
amazon:2systemd-sysv0
amazon:2systemd-networkd0
amazon:2systemd-libs0
chainguardpy3-systemd*

Timeline

  • Jan 7, 2019 CVE Published
  • Jan 10, 2019 PoC Published (2 in total, the first dated here)
  • Apr 14, 2021 EPSS Score (30 in total, the first dated here)
  • Jun 9, 2025 CVE Updated
  • Mar 6, 2026 Distribution Patch (6 in total, the first dated here)
  • Mar 6, 2026 Security Advisory (10 in total, the first dated here)
  • Sep 23, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2018-16866
vulnetix vdb fixes CVE-2018-16866

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2018-16866/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›