title: wicked: Use-after-free when receiving invalid DHCP6 IA_PD option
description: A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior to 0.6.60-2.18.1. SUSE Linux Enterprise Server 15 wicked versions prior to 0.6.60-28.26.1. openSUSE Leap 15.1 wicked versions prior to 0.6.60-lp151.2.9.1. openSUSE Factory wicked versions prior to 0.6.62.
problem types: CWE-416: Use After Free
affected:
{
product: SUSE Linux Enterprise Server 12
vendor: SUSE
versions:
lessThan: 0.6.60-2.18.1, status: affected, version: wicked, versionType: custom
}
{
product: SUSE Linux Enterprise Server 15
vendor: SUSE
versions:
lessThan: 0.6.60-28.26.1, status: affected, version: wicked, versionType: custom
}
{
product: Leap 15.1
vendor: openSUSE
versions:
lessThan: 0.6.60-lp151.2.9.1, status: affected, version: wicked, versionType: custom
}
{
product: Factory
vendor: openSUSE
versions:
lessThan:  0.6.62, status: affected, version: wicked, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]