CVE-2019-18902
wicked: Use-after-free when receiving invalid DHCP6 client options
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
wicked: Use-after-free when receiving invalid DHCP6 client options
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.
- Record
CVE-2019-18902- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2019-8583
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.
- Record
EUVD-2019-8583- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vj69-jmfq-4mjc No score
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux...
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.
- Record
GHSA-vj69-jmfq-4mjc- Updated
- 2026-11-02
NVD
A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-3.5.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-3.21.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.6.1. openSUSE Factory wicked versions prior to 0.6.62.
- Record
CVE-2019-18902- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0165-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:0165-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11511-1 No score
wicked-0.6.66-1.2 on GA media
These are all security issues fixed in the wicked-0.6.66-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11511-1- Updated
- 2026-11-02
Show 6 moreShow less
OSVSUSE-SU-2020:0263-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- Record
SUSE-SU-2020:0263-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0264-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- Record
SUSE-SU-2020:0264-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0351-1 No score
Security update for wicked
This update for wicked fixes the following issues:
Security issues fixed:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
Non-security issue fixed:
- dhcp4: Fixed an intermittent hang during network setup by cleaning up the defer timer pointer (bsc#1142214).
- Record
SUSE-SU-2020:0351-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0358-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
- Record
SUSE-SU-2020:0358-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0369-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
- Record
SUSE-SU-2020:0369-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0410-1 No score
Security update for wicked
This update for wicked fixes the following issues:
- CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options (bsc#1160903).
- CVE-2019-18903: Fixed a use-after-free when receiving invalid DHCP6 IA_PD option (bsc#1160904).
- CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 (bsc#1160905).
- CVE-2020-7217: Fixed a memory leak in DHCP4 fsm when processing packets for other client ids (bsc#1160906).
- Record
SUSE-SU-2020:0410-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wickedSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 2 CVEs |
before 0.6.60-3.21.1 | 0.6.60-3.21.1 |
wickedSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 2 CVEs |
before 0.6.60-3.21.1 | 0.6.60-3.21.1 |
wickedSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 2 CVEs |
before 0.6.60-3.21.1 | 0.6.60-3.21.1 |
wickedSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 2 CVEs |
before 0.6.60-3.21.1 | 0.6.60-3.21.1 |
wickedSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 2 CVEs |
before 0.6.60-3.21.1 | 0.6.60-3.21.1 |
wickedSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 2 CVEs |
before 0.6.60-3.10.1 | 0.6.60-3.10.1 |
wickedSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 4 CVEs |
before 0.6.60-3.5.1 | 0.6.60-3.5.1 |
wickedSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 4 CVEs |
before 0.6.60-3.5.1 | 0.6.60-3.5.1 |
wickedSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 4 CVEs |
before 0.6.60-28.26.1 | 0.6.60-28.26.1 |
wickedSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 4 CVEs |
before 0.6.60-28.26.1 | 0.6.60-28.26.1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wickedSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 4 CVEs |
before 0.6.60-2.18.1 | 0.6.60-2.18.1 |
wickedSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 4 CVEs |
before 0.6.60-2.18.1 | 0.6.60-2.18.1 |
wickedSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 4 CVEs |
before 0.6.60-2.18.1 | 0.6.60-2.18.1 |
wickedopenSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 0.6.60-lp151.2.6.1 | 0.6.60-lp151.2.6.1 |
wickedopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 0.6.66-1.2 | 0.6.66-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-18902 is a high vulnerability (CVSS 7.5) in Opensuse Factory, published January 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. No source names a fixed version.
References
bugzilla.suse.com/show_bug.cgi?id=1160903
nvd.nist.gov/vuln/detail/CVE-2019-18902
github.com/advisories/GHSA-vj69-jmfq-4mjc
suse.com/support/update/announcement/2020/suse-su-20200263-1
Show 13 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/55RNXZKH4PSOKZNDW22GXYEX3B5SP3I2