{"id":"CVE-2018-19416","aliases":["DEBIAN-CVE-2018-19416","EUVD-2018-11108","GHSA-97xc-q363-prgw","MGASA-2019-0168","SUSE-SU-2019:0806-1","SUSE-SU-2019:1326-1","openSUSE-SU-2019:1176-1","openSUSE-SU-2024:11419-1"],"status":"published","title":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of...","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01715,"percentile":0.77606,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2018-11-21T19:00:00Z","modified":"2026-10-20T10:50:24Z","fixes":[{"ecosystem":"Debian:12","package":"sysstat","fixed_in":["12.0.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sysstat","fixed_in":["12.0.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sysstat","fixed_in":["12.0.3-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-2"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.4-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-3.6.12"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-3.6.12"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-lp150.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.3-3.2"}]}],"bundled":5}],"products":[{"vendor":"sysstat_project","product":"sysstat"}],"references":[{"url":"http://www.securityfocus.com/bid/106010","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/sysstat/sysstat/issues/196","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19416"},{"url":"https://github.com/advisories/GHSA-97xc-q363-prgw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19416","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0168.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24765","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-04/msg00086.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190806-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1117001","tags":["report"]},{"url":"https://bugzilla.suse.com/1117260","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19517","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191326-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SNH2RYWORMRWHVRZ2WPJ4ZXGHYFQJ5NG/#SNH2RYWORMRWHVRZ2WPJ4ZXGHYFQJ5NG","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19725","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-19416","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.","status":"published","published":"2018-11-21T19:00:00Z","modified":"2026-10-15T17:38:21.647Z","updated_at":"2026-11-02T14:35:03.288698Z"}],"euvd":[{"id":"EUVD-2018-11108","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.","status":"published","published":"2018-11-21T19:00:00Z","modified":"2026-10-15T17:38:21Z","updated_at":"2026-11-02T17:00:11.403253Z"}],"ghsa":[{"id":"GHSA-97xc-q363-prgw","title":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of...","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.","status":"published","published":"2022-05-14T01:48:06Z","modified":"2023-02-02T05:04:32Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:51:53.84386Z"}],"nvd":[{"id":"CVE-2018-19416","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.","status":"published","published":"2018-11-21T20:29:00.26Z","modified":"2026-10-15T18:17:16.8Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:48.987926Z"}],"osv":[{"id":"CVE-2018-19416","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.","status":"published","published":"2018-11-21T20:29:00.26Z","modified":"2026-10-20T10:50:24.101673406Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-19416","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memmove call, as demonstrated by sadf.","status":"published","published":"2018-11-21T20:29:00.26Z","modified":"2026-10-15T21:47:29.557269438Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"MGASA-2019-0168","title":"Updated sysstat packages fix security vulnerabilities","description":"Updated sysstat package fix security vulnerabilities:\n\nOut-of-bounds read during a memmove call inside the remap_struct\nfunction (CVE-2018-19416).\n\nOut-of-bounds read during a memset call inside the remap_struct\nfunction (CVE-2018-19517).\n","status":"published","published":"2019-05-12T09:35:33Z","modified":"2026-04-16T04:41:31.05260882Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1176-1","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-19416: Fixed out-of-bounds read during a memmove call inside the remap_struct function (bsc#1117001).\n- CVE-2018-19517: Fixed out-of-bounds read during a memset call inside the remap_struct function (bsc#1117260).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-08T09:12:59Z","modified":"2026-02-04T02:19:41.964788Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11419-1","title":"sysstat-12.4.3-3.2 on GA media","description":"These are all security issues fixed in the sysstat-12.4.3-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:53.917004Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:0806-1","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-19416: Fixed out-of-bounds read during a memmove call inside the remap_struct function (bsc#1117001).\n- CVE-2018-19517: Fixed out-of-bounds read during a memset call inside the remap_struct function (bsc#1117260).\n","status":"published","published":"2019-03-29T12:16:58Z","modified":"2026-02-04T02:34:11.572128Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1326-1","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-19416: Fixed out-of-bounds read during a memmove call inside the remap_struct function (bsc#1117001).\n- CVE-2018-19517: Fixed out-of-bounds read during a memset call inside the remap_struct function (bsc#1117260).\n","status":"published","published":"2019-05-23T13:18:42Z","modified":"2026-02-04T03:04:12.886972Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}