CVE:CVE-2018-18409
CNNVD:CNNVD-201810-789
TCPFLOW是一款记录TCP会话的网络监视工具。
TCPFLOW 1.5.0版本中的iptree.h文件的‘setbit()’函数存在基于栈的缓冲区越界读取漏洞，该漏洞源于程序接收了错误值，从而导致计算错误。攻击者可利用该漏洞在‘address_histogram’函数调用或‘get_histogram’函数调用过程中造成拒绝服务。
solution:Upgrade digitalcorpora tcpflow to a higher version than 1.5.0,and avoid the version 1.5.0; Upgrade fedoraproject fedora to a higher version than 28,29,and avoid the version 28,29; Upgrade canonical ubuntu_linux to a higher version than 16.04,18.04,18.10,and avoid the version 16.04,18.04,18.10