{"id":"CVE-2018-19517","aliases":["DEBIAN-CVE-2018-19517","EUVD-2018-11206","GHSA-54j6-397f-4j69","SUSE-SU-2019:0806-1","SUSE-SU-2019:1326-1","openSUSE-SU-2019:1176-1","openSUSE-SU-2024:11419-1"],"status":"published","title":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of...","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00824,"percentile":0.57697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2018-11-24T18:00:00Z","modified":"2026-10-20T10:50:24Z","fixes":[{"ecosystem":"Debian:12","package":"sysstat","fixed_in":["12.0.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sysstat","fixed_in":["12.0.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sysstat","fixed_in":["12.0.3-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-3.6.12"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-3.6.12"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.2-lp150.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sysstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.3-3.2"}]}],"bundled":5}],"products":[{"vendor":"sysstat_project","product":"sysstat"}],"references":[{"url":"https://github.com/sysstat/sysstat/issues/199","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19517"},{"url":"https://github.com/advisories/GHSA-54j6-397f-4j69"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19517","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190806-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1117001","tags":["report"]},{"url":"https://bugzilla.suse.com/1117260","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19517","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191326-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SNH2RYWORMRWHVRZ2WPJ4ZXGHYFQJ5NG/#SNH2RYWORMRWHVRZ2WPJ4ZXGHYFQJ5NG","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19725","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-19517","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.","status":"published","published":"2018-11-24T18:00:00Z","modified":"2026-10-15T17:38:39.935Z","updated_at":"2026-11-02T14:35:02.966615Z"}],"euvd":[{"id":"EUVD-2018-11206","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.","status":"published","published":"2018-11-24T18:00:00Z","modified":"2026-10-15T17:38:39Z","updated_at":"2026-11-02T17:00:11.403253Z"}],"ghsa":[{"id":"GHSA-54j6-397f-4j69","title":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of...","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.","status":"published","published":"2022-05-14T01:47:08Z","modified":"2023-02-02T05:04:31Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:51:53.265489Z"}],"nvd":[{"id":"CVE-2018-19517","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.","status":"published","published":"2018-11-24T18:29:00.18Z","modified":"2026-10-15T18:17:16.957Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:48.987926Z"}],"osv":[{"id":"CVE-2018-19517","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.","status":"published","published":"2018-11-24T18:29:00.18Z","modified":"2026-10-20T10:50:24.100990652Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-19517","description":"An issue was discovered in sysstat 12.1.1. The remap_struct function in sa_common.c has an out-of-bounds read during a memset call, as demonstrated by sadf.","status":"published","published":"2018-11-24T18:29:00.18Z","modified":"2026-10-15T21:47:28.43833698Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"openSUSE-SU-2019:1176-1","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-19416: Fixed out-of-bounds read during a memmove call inside the remap_struct function (bsc#1117001).\n- CVE-2018-19517: Fixed out-of-bounds read during a memset call inside the remap_struct function (bsc#1117260).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-08T09:12:59Z","modified":"2026-02-04T02:19:41.964788Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11419-1","title":"sysstat-12.4.3-3.2 on GA media","description":"These are all security issues fixed in the sysstat-12.4.3-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:53.917004Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:0806-1","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-19416: Fixed out-of-bounds read during a memmove call inside the remap_struct function (bsc#1117001).\n- CVE-2018-19517: Fixed out-of-bounds read during a memset call inside the remap_struct function (bsc#1117260).\n","status":"published","published":"2019-03-29T12:16:58Z","modified":"2026-02-04T02:34:11.572128Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1326-1","title":"Security update for sysstat","description":"This update for sysstat fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-19416: Fixed out-of-bounds read during a memmove call inside the remap_struct function (bsc#1117001).\n- CVE-2018-19517: Fixed out-of-bounds read during a memset call inside the remap_struct function (bsc#1117260).\n","status":"published","published":"2019-05-23T13:18:42Z","modified":"2026-02-04T03:04:12.886972Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}