CVE-2018-1000849: Input Validation
Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file, due to bugs in handling long link target name and the way a regular file is extracted.. This vulnerability appears to have been fixed in 2.6.10, 2.7.6, and 2.10.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this Alpine Linux vulnerability?
The vulnerability ID for this Alpine Linux vulnerability is CVE-2018-1000849.
What is the severity rating of CVE-2018-1000849?
CVE-2018-1000849 has a severity rating of 8.8 (high).
What is the affected software version range for CVE-2018-1000849?
The affected software versions for CVE-2018-1000849 are prior to 2.6.10, 2.7.6, and 2.10.1.
How can this vulnerability be exploited?
This vulnerability can be exploited by using a specially crafted APK-file to cause apk to write arbitrary data.
Are there any references for CVE-2018-1000849?
Yes, you can refer to the following links for more information: [1] [2] [3]