{"id":"CVE-2018-7738","aliases":["DEBIAN-CVE-2018-7738","DSA-4134-1","EUVD-2018-19453","GHSA-jh5x-7c5f-4c44","MGASA-2018-0237","SUSE-SU-2018:2066-1","SUSE-SU-2018:2071-1","SUSE-SU-2018:3926-1","SUSE-SU-2019:0390-1","SUSE-SU-2023:3268-1","SUSE-SU-2023:4372-1","SUSE-SU-2023:4512-1","UBUNTU-CVE-2018-7738","USN-4512-1"],"status":"published","title":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by...","description":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00429,"percentile":0.37343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-03-06T22:00:00Z","modified":"2026-10-23T18:03:09Z","fixes":[{"ecosystem":"Debian:12","package":"util-linux","fixed_in":["2.31.1-0.5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"util-linux","fixed_in":["2.31.1-0.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"util-linux","fixed_in":["2.31.1-0.5"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"util-linux","fixed_in":["2.29.2-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"util-linux","fixed_in":["2.28.2-2.1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"util-linux","fixed_in":["2.31.1-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"util-linux-systemd","fixed_in":["2.31.1-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"util-linux-systemd","fixed_in":["2.31.1-9.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-libmount","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"util-linux","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"util-linux-systemd","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"util-linux","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-libmount","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"util-linux","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"util-linux-systemd","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-libmount","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"util-linux","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"util-linux-systemd","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"util-linux","fixed_in":["2.29.2-3.8.1","2.29.2-3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-libmount","fixed_in":["2.28-44.18.38"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"util-linux","fixed_in":["2.28-44.18.18"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"util-linux-systemd","fixed_in":["2.28-44.18.25"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"python-libmount","fixed_in":["2.28-44.18.38"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"util-linux","fixed_in":["2.28-44.18.18"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"util-linux-systemd","fixed_in":["2.28-44.18.25"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"python-libmount","fixed_in":["2.28-44.18.38"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"util-linux","fixed_in":["2.28-44.18.18"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"util-linux-systemd","fixed_in":["2.28-44.18.25"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"python-libmount","fixed_in":["2.28-44.18.38"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"util-linux","fixed_in":["2.28-44.18.18"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"util-linux-systemd","fixed_in":["2.28-44.18.25"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"python-libmount","fixed_in":["2.28-44.18.38"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"util-linux","fixed_in":["2.28-44.18.18"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"util-linux-systemd","fixed_in":["2.28-44.18.25"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"util-linux","fixed_in":["2.33.2-4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"python-libmount","fixed_in":["2.33.2-4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"util-linux","fixed_in":["2.33.2-4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"util-linux-systemd","fixed_in":["2.33.2-4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"python-libmount","fixed_in":["2.33.2-4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"util-linux","fixed_in":["2.33.2-4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"util-linux-systemd","fixed_in":["2.33.2-4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"util-linux","fixed_in":["2.33.2-4.33.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-libmount","fixed_in":["2.31.1-150000.9.24.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-libmount","fixed_in":["2.31.1-150000.9.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"util-linux","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"util-linux-systemd","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"util-linux","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"util-linux-systemd","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"util-linux","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"util-linux-systemd","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"util-linux","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"util-linux-systemd","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"util-linux","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"util-linux-systemd","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"util-linux","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"util-linux-systemd","fixed_in":["2.33.2-150100.4.40.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"util-linux","fixed_in":["2.31.1-0.4ubuntu3.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.11-6","1:2.11-7","1:2.11-8","1:2.12.0-1","1:2.13.0-1","1:2.14.0-1","1:2.14.0-2","1:2.16.0-1","1:2.16.0-2","1:2.16.0-3","1:2.16.0-4","1:2.16.0-5","1:2.16.0-6","1:2.16.0-7","1:2.16.0-8"]},{"source":"osv","ecosystem":"Debian:13","package":"bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.16.0-7","1:2.16.0-8"]},{"source":"osv","ecosystem":"Debian:14","package":"bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.16.0-7","1:2.16.0-8"]},{"source":"osv","ecosystem":"Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-0.5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-0.5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-0.5"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-1+deb9u1"}]}],"versions":["2.29.2-1"]},{"source":"osv","ecosystem":"Mageia:6","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.2-2.1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-9.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.2-3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.38"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.18"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.25"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.38"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.18"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.25"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.38"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.18"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.25"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.38"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.18"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.25"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.38"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.18"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-44.18.25"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-4.33.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-150000.9.24.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-150000.9.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.2-150100.4.40.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-0.4ubuntu3.7"}]}],"versions":["2.30.1-0ubuntu4","2.30.2-0.1ubuntu1","2.30.2-0.1ubuntu2","2.30.2-0.1ubuntu3","2.31.1-0.4ubuntu2","2.31.1-0.4ubuntu3","2.31.1-0.4ubuntu3.1","2.31.1-0.4ubuntu3.2","2.31.1-0.4ubuntu3.3","2.31.1-0.4ubuntu3.4","2.31.1-0.4ubuntu3.5","2.31.1-0.4ubuntu3.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.1-0.4ubuntu3.7"}]}],"versions":["2.30.1-0ubuntu4","2.30.2-0.1ubuntu1","2.30.2-0.1ubuntu2","2.30.2-0.1ubuntu3","2.31.1-0.4ubuntu2","2.31.1-0.4ubuntu3","2.31.1-0.4ubuntu3.1","2.31.1-0.4ubuntu3.2","2.31.1-0.4ubuntu3.3","2.31.1-0.4ubuntu3.4","2.31.1-0.4ubuntu3.5","2.31.1-0.4ubuntu3.6"]}],"products":[{"vendor":"kernel","product":"util-linux"}],"references":[{"url":"https://github.com/karelzak/util-linux/issues/539","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.debian.org/security/2018/dsa-4134","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/103367","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugs.debian.org/892179","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/4512-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20241213-0002/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7738"},{"url":"https://security.netapp.com/advisory/ntap-20241213-0002"},{"url":"https://usn.ubuntu.com/4512-1"},{"url":"https://github.com/advisories/GHSA-jh5x-7c5f-4c44"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-7738","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0237.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22726","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/N76EQ5XFDZ7L4B2EBFLEF5PK476OERQB/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182066-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084300","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7738","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182071-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1072947","tags":["report"]},{"url":"https://bugzilla.suse.com/1078662","tags":["report"]},{"url":"https://bugzilla.suse.com/1080740","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183926-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190390-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233268-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194038","tags":["report"]},{"url":"https://bugzilla.suse.com/1213865","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234372-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234512-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-7738","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4512-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7738","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-7738","description":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.","status":"published","published":"2018-03-06T22:00:00Z","modified":"2024-12-13T13:09:22.233Z","updated_at":"2026-11-02T14:35:10.313768Z"}],"euvd":[{"id":"EUVD-2018-19453","description":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.","status":"published","published":"2018-03-06T22:00:00Z","modified":"2024-12-13T13:09:22Z","updated_at":"2026-11-03T00:04:35.519932Z"}],"ghsa":[{"id":"GHSA-jh5x-7c5f-4c44","title":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by...","description":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.","status":"published","published":"2022-05-13T01:16:06Z","modified":"2024-12-13T15:31:41Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:59:11.49172Z"}],"nvd":[{"id":"CVE-2018-7738","description":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.","status":"published","published":"2018-03-07T02:29:03.533Z","modified":"2026-06-17T02:03:37.56Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:04:23.783914Z"}],"osv":[{"id":"CVE-2018-7738","description":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.","status":"published","published":"2018-03-07T02:29:03.533Z","modified":"2026-10-20T10:50:30.437074646Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-7738","description":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.","status":"published","published":"2018-03-07T02:29:03.533Z","modified":"2026-10-23T18:03:09.276591201Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2018-7738","description":"In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.","status":"published","published":"2018-03-07T02:29:00Z","modified":"2026-04-22T12:03:02.844583Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DSA-4134-1","title":"util-linux - security update","status":"published","published":"2018-03-10T00:00:00Z","modified":"2026-03-09T01:22:27.282974Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0237","title":"Updated util-linux packages fix security vulnerability","description":"A command injection flaw was found in the way util-linux implements\numount autocompletion in Bash. An attacker with the ability to mount a\nfilesystem with custom mount points may execute arbitrary commands on\nbehalf of the user who triggers the umount autocompletion\n(CVE-2018-7738).\n","status":"published","published":"2018-05-16T08:24:56Z","modified":"2026-04-16T06:26:16.90829565Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2018:2066-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following security issue:\n\n- CVE-2018-7738: Fix local vulnerability using embedded shell commands in a\n  mountpoint name (bsc#1084300)\n","status":"published","published":"2018-07-26T14:25:34Z","modified":"2026-02-04T04:26:24.654413Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2071-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\nThis non-security issue was fixed:\n\n- CVE-2018-7738: bash-completion/umount allowed local users to gain privileges\n  by embedding shell commands in a mountpoint name, which was mishandled during a\n  umount command by a different user (bsc#1084300).\n\nThese non-security issues were fixed:\n\n- Fixed crash loop in lscpu (bsc#1072947).\n- Fixed possible segfault of umount -a\n- Fixed mount -a on NFS bind mounts (bsc#1080740).\n- Fixed lsblk on NVMe (bsc#1078662).\n","status":"published","published":"2018-07-26T14:32:36Z","modified":"2026-02-04T03:40:49.433249Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:3926-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\nThis non-security issue was fixed:\n\n- CVE-2018-7738: bash-completion/umount allowed local users to gain privileges\n  by embedding shell commands in a mountpoint name, which was mishandled during a\n  umount command by a different user (bsc#1084300).\n\nThese non-security issues were fixed:\n\n- Fixed crash loop in lscpu (bsc#1072947).\n- Fixed possible segfault of umount -a\n- Fixed mount -a on NFS bind mounts (bsc#1080740).\n- Fixed lsblk on NVMe (bsc#1078662).\n","status":"published","published":"2018-11-27T12:39:56Z","modified":"2026-02-04T03:59:56.871436Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2019:0390-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\nThis non-security issue was fixed:\n\n- CVE-2018-7738: bash-completion/umount allowed local users to gain privileges\n  by embedding shell commands in a mountpoint name, which was mishandled during a\n  umount command by a different user (bsc#1084300).\n\nThese non-security issues were fixed:\n\n- Fixed crash loop in lscpu (bsc#1072947).\n- Fixed possible segfault of umount -a\n- Fixed mount -a on NFS bind mounts (bsc#1080740).\n- Fixed lsblk on NVMe (bsc#1078662).\n  ","status":"published","published":"2019-02-14T13:44:08Z","modified":"2026-02-04T03:13:53.104495Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2023:3268-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2018-7738: Fixed shell code injection in umount bash-completions. (bsc#1213865, bsc#1084300)\n","status":"published","published":"2023-08-10T14:15:50Z","modified":"2026-02-04T02:48:28.941242Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:4372-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2018-7738: Fixed shell code injection in umount bash-completions (bsc#1213865).\n","status":"published","published":"2023-11-06T08:52:40Z","modified":"2026-02-04T03:37:59.35161Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4512-1","title":"Security update for util-linux","description":"This update for util-linux fixes the following issues:\n\n- CVE-2018-7738: Fixed shell code injection in umount bash-completions (bsc#1213865).\n","status":"published","published":"2023-11-21T16:25:31Z","modified":"2026-02-04T03:27:20.097494Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-4512-1","title":"util-linux vulnerability","description":"It was discovered that the umount bash completion script shipped in\nutil-linux incorrectly handled certain mountpoints. If a local attacker\nwere able to create arbitrary mountpoints, another user could be tricked\ninto executing arbitrary code when attempting to run the umount command\nwith bash completion.\n","status":"published","published":"2020-09-17T11:31:17Z","modified":"2026-04-22T10:07:09.944757Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}