WaratekVRT Sign in

CVE-2018-16866 systemd

Affected softwaresystemd
Severity3.3 Low CVSS 3.1 3 scores
WeaknessOut-of-bounds read (CWE-125)
Published11 Jan 2019
Updated17 Jun 2026

Description

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

CWE-200 · Information exposure

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 7 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 1.1% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

3.3 LOW v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 3.3 LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N NVD Primary published
CVSS 3.0 4.3 MEDIUM CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N secalert@redhat.com Secondary
CVSS 2.0 2.1 none AV:L/AC:L/Au:N/C:P/I:N/A:N NVD Primary

Affected software and releases

Products and versions

21 products, 27 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 16.04 · 18.04 · 18.10
nvd debian debian linux generic 9.0
nvd netapp active iq performance analytics services generic any version
nvd netapp element software generic any version
nvd redhat enterprise linux generic 7.6
nvd redhat enterprise linux compute node eus generic 7.6
nvd redhat enterprise linux desktop generic 7.0
nvd redhat enterprise linux for ibm z systems \(structure a\) generic 7_s390x
nvd redhat enterprise linux for ibm z systems eus generic 7.6
nvd redhat enterprise linux for power big endian generic 7.0
nvd redhat enterprise linux for power big endian eus generic 7.6
nvd redhat enterprise linux for power little endian generic 7.0
nvd redhat enterprise linux for power little endian eus generic 7.6
nvd redhat enterprise linux for scientific computing generic 7.0
nvd redhat enterprise linux server generic 7.0
nvd redhat enterprise linux server aus generic 7.4 · 7.6
nvd redhat enterprise linux server for power little endian update services for sap solutions generic 7.4 · 7.6
nvd redhat enterprise linux server tus generic 7.4 · 7.6
nvd redhat enterprise linux server update services for sap solutions generic 7.4 · 7.6
nvd redhat enterprise linux workstation generic 7.0
nvd systemd project systemd generic ≥ 221 and ≤ 239

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Products:** SYSTEMD

References

URLTags
http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/May/21 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/05/10/4 Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/106527 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2091 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3222 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0593 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16866 Issue Tracking, Patch, Third Party Advisory
https://seclists.org/bugtraq/2019/May/25 Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/201903-07 Third Party Advisory

Timeline
Published2019-01-11By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.