NULL pointer dereference in Avaya Communication Manager
CVE-2008-2812
The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2) hamradio/mkiss.c, (3) irda/irtty-sir.c, (4) ppp_async.c, (5) ppp_synctty.c, (6) slip.c, (7) wan/x25_asy.c, and (8) wireless/strip.c in drivers/net/.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (36.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Avaya Communication Manager
- Avaya Expanded Meet-Me Conferencing
- Avaya Intuity Audix Lx — versions 2.0
- Avaya Meeting Exchange — versions 5.0
- Avaya Message Networking — versions 3.1
- Avaya Messaging Storage Server — versions 4.0
- Avaya Proactive Contact — versions 4.0
- Avaya Sip Enablement Services — versions 4.0
- Linux Kernel
- Novell Linux Desktop — versions 9
Weakness classification (CWE)
References
- lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html (vendor-advisory, Mailing List, Third Party Advisory)
- www.debian.org/security/2008/dsa-1630 (vendor-advisory, Patch, Third Party Advisory)
- www.vupen.com/english/advisories/2008/2063/references (vdb-entry, Broken Link)
- git.kernel.org/
- lists.opensuse.org/opensuse-security-announce/2008-07/msg00012.html (vendor-advisory, Mailing List, Third Party Advisory)
- usn.ubuntu.com/637-1/ (vendor-advisory, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html (vendor-advisory, Mailing List, Third Party Advisory)
- www.openwall.com/lists/oss-security/2008/07/03/2 (mailing-list, Patch, Mailing List, Third Party Advisory)
- secunia.com/advisories/31614 (Broken Link, third-party-advisory)
- secunia.com/advisories/31685 (Broken Link, third-party-advisory)
Frequently asked questions
- What is CVE-2008-2812?
- CVE-2008-2812 is a high-severity vulnerability in Avaya Communication Manager, classified under NULL Pointer Dereference. CVSS score: 7.8/10. Published 2008-07-09.
- How severe is CVE-2008-2812?
- High severity. CVSS v3 base score is 7.8 out of 10.