procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - procps-ng, procps: incorrect integer size in proc/alloc.* leading to truncation / integer overflow issues     (CVE-2018-1126)

  - procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's     proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use     inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID,     thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by     exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng     up to version 3.3.15, newer versions might be affected also. (CVE-2018-1121)

  - procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top     with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by     exploiting one of several vulnerabilities in the config_file() function. (CVE-2018-1122)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - procps-ng, procps: Local privilege escalation in top (CVE-2018-1122)

  - procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's     proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use     inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID,     thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by     exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng     up to version 3.3.15, newer versions might be affected also. (CVE-2018-1121)

  - procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow.
    Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact     of this flaw is limited to a crash (temporary denial of service). (CVE-2018-1123)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - procps-ng, procps: process hiding through race condition enumerating /proc (CVE-2018-1121)

  - procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow.
    Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact     of this flaw is limited to a crash (temporary denial of service). (CVE-2018-1123)

  - procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is     mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with     FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash. (CVE-2018-1125)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

This update for procps fixes the following issues :

procps was updated to 3.3.15. (bsc#1092100)

Following security issues were fixed :

  - CVE-2018-1122: Prevent local privilege escalation in     top. If a user ran top with HOME unset in an     attacker-controlled directory, the attacker could have     achieved privilege escalation by exploiting one of     several vulnerabilities in the config_file() function     (bsc#1092100).

  - CVE-2018-1123: Prevent denial of service in ps via mmap     buffer overflow. Inbuilt protection in ps maped a guard     page at the end of the overflowed buffer, ensuring that     the impact of this flaw is limited to a crash (temporary     denial of service) (bsc#1092100).

  - CVE-2018-1124: Prevent multiple integer overflows     leading to a heap corruption in file2strvec function.
    This allowed a privilege escalation for a local attacker     who can create entries in procfs by starting processes,     which could result in crashes or arbitrary code     execution in proc utilities run by other users     (bsc#1092100).

  - CVE-2018-1125: Prevent stack-based buffer overflow in     pgrep. This vulnerability was mitigated by FORTIFY     limiting the impact to a crash (bsc#1092100).

  - CVE-2018-1126: Ensure correct integer size in     proc/alloc.* to prevent truncation/integer overflow     issues (bsc#1092100).

Also this non-security issue was fixed :

  - Fix CPU summary showing old data. (bsc#1121753)

The update to 3.3.15 contains the following fixes :

  - library: Increment to 8:0:1 No removals, no new     functions Changes: slab and pid structures

  - library: Just check for SIGLOST and don't delete it

  - library: Fix integer overflow and LPE in file2strvec     CVE-2018-1124

  - library: Use size_t for alloc functions CVE-2018-1126

  - library: Increase comm size to 64

  - pgrep: Fix stack-based buffer overflow CVE-2018-1125

  - pgrep: Remove >15 warning as comm can be longer

  - ps: Fix buffer overflow in output buffer, causing DOS     CVE-2018-1123

  - ps: Increase command name selection field to 64

  - top: Don't use cwd for location of config CVE-2018-1122

  - update translations

  - library: build on non-glibc systems

  - free: fix scaling on 32-bit systems

  - Revert 'Support running with child namespaces'

  - library: Increment to 7:0:1 No changes, no removals New     fuctions: numa_init, numa_max_node, numa_node_of_cpu,     numa_uninit, xalloc_err_handler

  - doc: Document I idle state in ps.1 and top.1

  - free: fix some of the SI multiples

  - kill: -l space between name parses correctly

  - library: dont use vm_min_free on non Linux

  - library: don't strip off wchan prefixes (ps & top)

  - pgrep: warn about 15+ char name only if -f not used

  - pgrep/pkill: only match in same namespace by default

  - pidof: specify separator between pids

  - pkill: Return 0 only if we can kill process

  - pmap: fix duplicate output line under '-x' option

  - ps: avoid eip/esp address truncations

  - ps: recognizes SCHED_DEADLINE as valid CPU scheduler

  - ps: display NUMA node under which a thread ran

  - ps: Add seconds display for cputime and time

  - ps: Add LUID field

  - sysctl: Permit empty string for value

  - sysctl: Don't segv when file not available

  - sysctl: Read and write large buffers

  - top: add config file support for XDG specification

  - top: eliminated minor libnuma memory leak

  - top: show fewer memory decimal places (configurable)

  - top: provide command line switch for memory scaling

  - top: provide command line switch for CPU States

  - top: provides more accurate cpu usage at startup

  - top: display NUMA node under which a thread ran

  - top: fix argument parsing quirk resulting in SEGV

  - top: delay interval accepts non-locale radix point

  - top: address a wishlist man page NLS suggestion

  - top: fix potential distortion in 'Mem' graph display

  - top: provide proper multi-byte string handling

  - top: startup defaults are fully customizable

  - watch: define HOST_NAME_MAX where not defined

  - vmstat: Fix alignment for disk partition format

  - watch: Support ANSI 39,49 reset sequences

This update was imported from the SUSE:SLE-15:Update update project.

This update for procps fixes the following issues :

procps was updated to 3.3.15. (bsc#1092100)

Following security issues were fixed :

CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100).

CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100).

CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100).

CVE-2018-1125: Prevent stack-based buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100).

CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100).

Also 

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for procps fixes the following security issues :

  - CVE-2018-1122: Prevent local privilege escalation in     top. If a user ran top with HOME unset in an     attacker-controlled directory, the attacker could have     achieved privilege escalation by exploiting one of     several vulnerabilities in the config_file() function     (bsc#1092100).

  - CVE-2018-1123: Prevent denial of service in ps via mmap     buffer overflow. Inbuilt protection in ps maped a guard     page at the end of the overflowed buffer, ensuring that     the impact of this flaw is limited to a crash (temporary     denial of service) (bsc#1092100).

  - CVE-2018-1124: Prevent multiple integer overflows     leading to a heap corruption in file2strvec function.
    This allowed a privilege escalation for a local attacker     who can create entries in procfs by starting processes,     which could result in crashes or arbitrary code     execution in proc utilities run by other users     (bsc#1092100).

  - CVE-2018-1125: Prevent stack-based buffer overflow in     pgrep. This vulnerability was mitigated by FORTIFY     limiting the impact to a crash (bsc#1092100).

  - CVE-2018-1126: Ensure correct integer size in     proc/alloc.* to prevent truncation/integer overflow     issues (bsc#1092100).

(These issues were previously released for SUSE Linux Enterprise 12 SP3 and SP4.)

Also the following non-security issue was fixed :

  - Fix CPU summary showing old data. (bsc#1121753)

This update was imported from the SUSE:SLE-12:Update update project.

This update for procps fixes the following security issues :

CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100).

CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100).

CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100).

CVE-2018-1125: Prevent stack-based buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100).

CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100).

(These issues were previously released for SUSE Linux Enterprise 12 SP3 and SP4.)

Also 

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the procps package has been released.

This update for procps fixes the following security issues :

CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top with HOME unset in an attacker-controlled directory, the attacker could have achieved privilege escalation by exploiting one of several vulnerabilities in the config_file() function (bsc#1092100).

CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maped a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service) (bsc#1092100).

CVE-2018-1124: Prevent multiple integer overflows leading to a heap corruption in file2strvec function. This allowed a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users (bsc#1092100).

CVE-2018-1125: Prevent stack-based buffer overflow in pgrep. This vulnerability was mitigated by FORTIFY limiting the impact to a crash (bsc#1092100).

CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent truncation/integer overflow issues (bsc#1092100).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the procps-ng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - If the HOME environment variable is unset or empty, top     will read its configuration file from the current     working directory without any security check. If a user     runs top with HOME unset in an attacker-controlled     directory, the attacker could achieve privilege     escalation by exploiting one of several vulnerabilities     in the config_file() function.(CVE-2018-1122)

  - Due to incorrect accounting when decoding and escaping     Unicode data in procfs, ps is vulnerable to overflowing     an mmap()ed region when formatting the process list for     display. Since ps maps a guard page at the end of the     buffer, impact is limited to a crash.(CVE-2018-1123)

  - If an argument longer than INT_MAX bytes is given to     pgrep, 'int bytes' could wrap around back to a large     positive int (rather than approaching zero), leading to     a stack buffer overflow via strncat().(CVE-2018-1125)

  - procps-ng, procps: Integer overflows leading to heap     overflow in file2strvec (CVE-2018-1124)

  - procps-ng, procps: incorrect integer size in     proc/alloc.* leading to truncation / integer overflow     issues (CVE-2018-1126)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the procps-ng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - If the HOME environment variable is unset or empty, top     will read its configuration file from the current     working directory without any security check. If a user     runs top with HOME unset in an attacker-controlled     directory, the attacker could achieve privilege     escalation by exploiting one of several vulnerabilities     in the config_file() function.(CVE-2018-1122)

  - Due to incorrect accounting when decoding and escaping     Unicode data in procfs, ps is vulnerable to overflowing     an mmap()ed region when formatting the process list for     display. Since ps maps a guard page at the end of the     buffer, impact is limited to a crash.(CVE-2018-1123)

  - If an argument longer than INT_MAX bytes is given to     pgrep, 'int bytes' could wrap around back to a large     positive int (rather than approaching zero), leading to     a stack buffer overflow via strncat().(CVE-2018-1125)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the procps-ng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - If the HOME environment variable is unset or empty, top     will read its configuration file from the current     working directory without any security check. If a user     runs top with HOME unset in an attacker-controlled     directory, the attacker could achieve privilege     escalation by exploiting one of several vulnerabilities     in the config_file() function.(CVE-2018-1122)

  - Due to incorrect accounting when decoding and escaping     Unicode data in procfs, ps is vulnerable to overflowing     an mmap()ed region when formatting the process list for     display. Since ps maps a guard page at the end of the     buffer, impact is limited to a crash.(CVE-2018-1123)

  - If an argument longer than INT_MAX bytes is given to     pgrep, 'int bytes' could wrap around back to a large     positive int (rather than approaching zero), leading to     a stack buffer overflow via strncat().(CVE-2018-1125)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for procps fixes the following security issues :

  - CVE-2018-1122: Prevent local privilege escalation in     top. If a user ran top with HOME unset in an     attacker-controlled directory, the attacker could have     achieved privilege escalation by exploiting one of     several vulnerabilities in the config_file() function     (bsc#1092100).

  - CVE-2018-1123: Prevent denial of service in ps via mmap     buffer overflow. Inbuilt protection in ps maped a guard     page at the end of the overflowed buffer, ensuring that     the impact of this flaw is limited to a crash (temporary     denial of service) (bsc#1092100).

  - CVE-2018-1124: Prevent multiple integer overflows     leading to a heap corruption in file2strvec function.
    This allowed a privilege escalation for a local attacker     who can create entries in procfs by starting processes,     which could result in crashes or arbitrary code     execution in proc utilities run by other users     (bsc#1092100).

  - CVE-2018-1125: Prevent stack-based buffer overflow in     pgrep. This vulnerability was mitigated by FORTIFY     limiting the impact to a crash (bsc#1092100).

  - CVE-2018-1126: Ensure correct integer size in     proc/alloc.* to prevent truncation/integer overflow     issues (bsc#1092100).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the procps-ng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - procps-ng, procps: Integer overflows leading to heap     overflow in file2strvec (CVE-2018-1124)

  - procps-ng, procps: incorrect integer size in     proc/alloc.* leading to truncation / integer overflow     issues (CVE-2018-1126)

  - If the HOME environment variable is unset or empty, top     will read its configuration file from the current     working directory without any security check. If a user     runs top with HOME unset in an attacker-controlled     directory, the attacker could achieve privilege     escalation by exploiting one of several vulnerabilities     in the config_file() function.(CVE-2018-1122)

  - Due to incorrect accounting when decoding and escaping     Unicode data in procfs, ps is vulnerable to overflowing     an mmap()ed region when formatting the process list for     display. Since ps maps a guard page at the end of the     buffer, impact is limited to a crash.(CVE-2018-1123)

  - If an argument longer than INT_MAX bytes is given to     pgrep, 'int bytes' could wrap around back to a large     positive int (rather than approaching zero), leading to     a stack buffer overflow via strncat().(CVE-2018-1125)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for procps fixes the following security issues :

  - CVE-2018-1122: Prevent local privilege escalation in     top. If a user ran top with HOME unset in an     attacker-controlled directory, the attacker could have     achieved privilege escalation by exploiting one of     several vulnerabilities in the config_file() function     (bsc#1092100).

  - CVE-2018-1123: Prevent denial of service in ps via mmap     buffer overflow. Inbuilt protection in ps maped a guard     page at the end of the overflowed buffer, ensuring that     the impact of this flaw is limited to a crash (temporary     denial of service) (bsc#1092100).

  - CVE-2018-1124: Prevent multiple integer overflows     leading to a heap corruption in file2strvec function.
    This allowed a privilege escalation for a local attacker     who can create entries in procfs by starting processes,     which could result in crashes or arbitrary code     execution in proc utilities run by other users     (bsc#1092100).

  - CVE-2018-1125: Prevent stack-based buffer overflow in     pgrep. This vulnerability was mitigated by FORTIFY     limiting the impact to a crash (bsc#1092100).

  - CVE-2018-1126: Ensure correct integer size in     proc/alloc.* to prevent truncation/integer overflow     issues (bsc#1092100).

This update was imported from the SUSE:SLE-12:Update update project.

The Qualys Research Labs discovered multiple vulnerabilities in procps, a set of command line and full screen utilities for browsing procfs. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2018-1122

top read its configuration from the current working directory if no $HOME was configured. If top were started from a directory writable by the attacker (such as /tmp) this could result in local privilege escalation.

CVE-2018-1123

Denial of service against the ps invocation of another user.

CVE-2018-1124

An integer overflow in the file2strvec() function of libprocps could result in local privilege escalation.

CVE-2018-1125

A stack-based buffer overflow in pgrep could result in denial of service for a user using pgrep for inspecting a specially crafted process.

CVE-2018-1126

Incorrect integer size parameters used in wrappers for standard C allocators could cause integer truncation and lead to integer overflow issues.

For Debian 7 'Wheezy', these problems have been fixed in version 1:3.3.3-3+deb7u1.

We recommend that you upgrade your procps packages.

The Debian LTS team would like to thank Abhijith PA for preparing this update.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3658-1 advisory.

    It was discovered that the procps-ng top utility incorrectly read its configuration file from the current     working directory. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-1122)

    It was discovered that the procps-ng ps tool incorrectly handled memory. A local user could possibly use     this issue to cause a denial of service. (CVE-2018-1123)

    It was discovered that libprocps incorrectly handled the file2strvec() function. A local attacker could     possibly use this to execute arbitrary code. (CVE-2018-1124)

    It was discovered that the procps-ng pgrep utility incorrectly handled memory. A local attacker could     possibly use this issue to cause de denial of service. (CVE-2018-1125)

    It was discovered that procps-ng incorrectly handled memory. A local attacker could use this issue to     cause a denial of service, or possibly execute arbitrary code. (CVE-2018-1126)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Qualys Research Labs discovered multiple vulnerabilities in procps, a set of command line and full screen utilities for browsing procfs. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2018-1122     top read its configuration from the current working     directory if no $HOME was configured. If top were     started from a directory writable by the attacker (such     as /tmp) this could result in local privilege     escalation.

  - CVE-2018-1123     Denial of service against the ps invocation of another     user.

  - CVE-2018-1124     An integer overflow in the file2strvec() function of     libprocps could result in local privilege escalation.

  - CVE-2018-1125     A stack-based buffer overflow in pgrep could result in     denial of service for a user using pgrep for inspecting     a specially crafted process.

  - CVE-2018-1126     Incorrect integer size parameters used in wrappers for     standard C allocators could cause integer truncation and     lead to integer overflow issues.

New procps-ng packages are available for Slackware 14.2 and -current to fix security issues.

ID	Name	Product	Family	Severity
199909	RHEL 5 : procps (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199871	RHEL 6 : procps (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199834	RHEL 7 : procps (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
195799	RHEL 6 : procps-ng,_procps (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195796	RHEL 5 : procps-ng,_procps (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195777	RHEL 7 : procps-ng,_procps (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
130334	openSUSE Security Update : procps (openSUSE-2019-2379)	Nessus	SuSE Local Security Checks	critical
130333	openSUSE Security Update : procps (openSUSE-2019-2376)	Nessus	SuSE Local Security Checks	critical
130145	SUSE SLED15 / SLES15 Security Update : procps (SUSE-SU-2019:2730-1)	Nessus	SuSE Local Security Checks	critical
122607	openSUSE Security Update : procps (openSUSE-2019-291)	Nessus	SuSE Local Security Checks	critical
122361	SUSE SLED12 / SLES12 Security Update : procps (SUSE-SU-2019:0450-1)	Nessus	SuSE Local Security Checks	critical
121983	Photon OS 2.0: Procps PHSA-2018-2.0-0084	Nessus	PhotonOS Local Security Checks	critical
121877	Photon OS 1.0: Procps PHSA-2018-1.0-0175	Nessus	PhotonOS Local Security Checks	critical
119211	SUSE SLED12 / SLES12 Security Update : procps (SUSE-SU-2018:2451-2)	Nessus	SuSE Local Security Checks	critical
118428	EulerOS Virtualization 2.5.0 : procps-ng (EulerOS-SA-2018-1340)	Nessus	Huawei Local Security Checks	critical
118414	EulerOS Virtualization 2.5.1 : procps-ng (EulerOS-SA-2018-1326)	Nessus	Huawei Local Security Checks	high
111650	EulerOS 2.0 SP3 : procps-ng (EulerOS-SA-2018-1230)	Nessus	Huawei Local Security Checks	high
111264	SUSE SLES11 Security Update : procps (SUSE-SU-2018:2042-1)	Nessus	SuSE Local Security Checks	critical
110862	EulerOS 2.0 SP2 : procps-ng (EulerOS-SA-2018-1198)	Nessus	Huawei Local Security Checks	critical
110830	openSUSE Security Update : procps (openSUSE-2018-685)	Nessus	SuSE Local Security Checks	critical
110804	SUSE SLED12 / SLES12 Security Update : procps (SUSE-SU-2018:1836-1)	Nessus	SuSE Local Security Checks	critical
110312	Debian DLA-1390-1 : procps security update	Nessus	Debian Local Security Checks	critical
110094	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : procps-ng vulnerabilities (USN-3658-1)	Nessus	Ubuntu Local Security Checks	critical
109969	Debian DSA-4208-1 : procps - security update	Nessus	Debian Local Security Checks	critical
109950	Slackware 14.2 / current : procps-ng (SSA:2018-142-03)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2018-1125

high

Tenable Plugins

critical

high

medium

high

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical