Every CVE Search/ Get API key

CVE-2018-14622

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The...

5.3 MediumFix available

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

3.86%Up 1.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.3

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

Record
CVE-2018-14622
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-252
Updated
2026-11-02
EUVDEUVD-2018-6529 5.3

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

Record
EUVD-2018-6529
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-359h-vjp2-hp47 7.5

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The...

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

Record
GHSA-359h-vjp2-hp47
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-252
Updated
2026-11-02
NVD 7.5

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

Record
CVE-2018-14622
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-252
Updated
2026-11-02
OSVBELL-CVE-2018-14622 7.5

CVE-2018-14622 does not affect BellSoft software

Record
BELL-CVE-2018-14622
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

Record
CVE-2018-14622
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2018-14622 7.5

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

Record
DEBIAN-CVE-2018-14622
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHBA-2017:1991 5.3

Red Hat Bug Fix Advisory: libtirpc bug fix update

Record
RHBA-2017:1991
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2018-14622 7.5

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

Record
UBUNTU-CVE-2018-14622
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2018:3146-1 No score

Security update for libtirpc

This update for libtirpc fixes the following issues:

Security issues fixed:

  • CVE-2018-14621: libtirpc: Infinite loop in EMFILE case in svc_vc.c (bsc#1106519)
  • CVE-2018-14622: libtirpc: Segmentation fault in makefd_xprt return value in svc_vc.c (bsc#1106517)
Record
SUSE-SU-2018:3146-1
Updated
2026-11-02
OSVUSN-3759-1 No score

libtirpc vulnerabilities

Aldy Hernandez discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-4429)

It was discovered that libtirpc incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14622)

It was discovered that libtirpc incorrectly handled certain strings. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-8779)

Record
USN-3759-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtirpc
Debian:12
 before 0.2.5-1.3
0.2.5-1.3
libtirpc
Debian:13
 before 0.2.5-1.3
0.2.5-1.3
libtirpc
Debian:14
 before 0.2.5-1.3
0.2.5-1.3
libtirpc
Debian:8
 before 0.2.5-1+deb8u2, plus listed versions
0.2.5-10.2.5-1+deb8u1
0.2.5-1+deb8u2
libtirpc-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc-devel
Red Hat:enterprise_linux:7::client
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc
Red Hat:enterprise_linux:7::client
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc-devel
Red Hat:enterprise_linux:7::computenode
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc
Red Hat:enterprise_linux:7::computenode
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
Show 15 moreShow less
Affected packages
PackageAffectedFixed
libtirpc-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc-devel
Red Hat:enterprise_linux:7::server
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc
Red Hat:enterprise_linux:7::server
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc
Red Hat:enterprise_linux:7::workstation
 before 0:0.2.4-0.10.el7
0:0.2.4-0.10.el7
libtirpc
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 2 CVEs
 before 0.2.1-1.13.6.1
0.2.1-1.13.6.1
libtirpc
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 2 CVEs
 before 0.2.1-1.13.6.1
0.2.1-1.13.6.1
libtirpc
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 2 CVEs
 before 0.2.1-1.13.6.1
0.2.1-1.13.6.1
libtirpc
Ubuntu:14.04:LTS
 before 0.2.2-5ubuntu2.1, plus listed versions
0.2.2-5ubuntu10.2.2-5ubuntu2
0.2.2-5ubuntu2.1
libtirpc
Ubuntu:16.04:LTS
 before 0.2.5-1ubuntu0.1, plus listed versions
0.2.5-1
0.2.5-1ubuntu0.1
libtirpc
Ubuntu:18.04:LTS
 before 0.2.5-1.2ubuntu0.1, plus listed versions
0.2.5-1.2
0.2.5-1.2ubuntu0.1
libtirpc
Ubuntu:14.04:LTS
From an advisory covering 3 CVEs
 before 0.2.2-5ubuntu2.1, plus listed versions
0.2.2-5ubuntu10.2.2-5ubuntu2
0.2.2-5ubuntu2.1
libtirpc
Ubuntu:16.04:LTS
From an advisory covering 3 CVEs
 before 0.2.5-1ubuntu0.1, plus listed versions
0.2.5-1
0.2.5-1ubuntu0.1
libtirpc
Ubuntu:18.04:LTS
From an advisory covering 3 CVEs
 before 0.2.5-1.2ubuntu0.1, plus listed versions
0.2.5-1.2
0.2.5-1.2ubuntu0.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-14622 is a medium vulnerability (CVSS 5.3) in [unknown] Libtirpc, published August 30, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.86%, the 90th percentile. Fixed in libtirpc 0.2.5-1.3.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open