CVE-2018-21027
- Source
- https://cve.org/CVERecord?id=CVE-2018-21027
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-21027.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-21027
- Published
- 2019-10-11T20:15:16.783Z
- Modified
- 2026-07-08T19:45:30.968089Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:boa:boa:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "last_affected": "0.94.14.21" } ], "vendor_product": "boa:boa", "source": "CPE_RANGE" } ] }- References
Affected packages
Git / github.com/gpg/boa
Affected versions
upstream/0.*
upstream/0.92
upstream/0.93.14.1
upstream/0.93.15
upstream/0.94.11
upstream/0.94.14rc20
upstream/0.94.8.3
Database specific
vanir_signatures
[
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "220823450193352790724761540728821885038",
"length": 3200.0
},
"deprecated": false,
"id": "CVE-2018-21027-0118645c",
"target": {
"function": "index_directory",
"file": "src/index_dir.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"63294334405628449755993857779164787479",
"94825566254764396466132626758414897210",
"254549519308419991802351374028084607042",
"159357826781110764526351251346237153504",
"94714379446337151222953622276476898379",
"295765914123914240085405891609149900387",
"205978025721534729999402728045140100272",
"44262611751600843786294860943853469483",
"235877700460936932581392841685179540442",
"297325145783158178268087026438646119336",
"29552156337489209615026069301120955770",
"265571979369147997703247110319034314742",
"160615315031842019398178858862123703886",
"4344267942487811008734257676104218316",
"97536690181014371732153657852833915624",
"127512292933809808258435471450280890583",
"64792851290417272509341044435230451781",
"299958241328134890469188886815132247700",
"179771660679661120997837090816985929143"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-0a0808a1",
"target": {
"file": "src/pipe.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"309885841744986551993858678284861686744",
"53106768525200875161288343078150006742",
"306950623800313744729735625330820813366",
"150336388632771840084281197680498498562",
"91150829873695970955222033578640847695",
"325652023644520917764499648558566349302",
"225430467537952276621259709166074145553",
"225751867887304301517054735768375620406",
"300677330618268414948430583178361054972"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-20f3d8ee",
"target": {
"file": "src/range.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "57514279541819056004580925140866004253",
"length": 356.0
},
"deprecated": false,
"id": "CVE-2018-21027-26baa42b",
"target": {
"function": "sighup_run",
"file": "src/signals.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "69886775732869681843709187800838380941",
"length": 318.0
},
"deprecated": false,
"id": "CVE-2018-21027-2b6fa662",
"target": {
"function": "release_mmap",
"file": "src/mmap_cache.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "260762484014441032722805197646831419437",
"length": 288.0
},
"deprecated": false,
"id": "CVE-2018-21027-334bbff6",
"target": {
"function": "open_gen_fd",
"file": "src/sublog.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "99337924851108423224193580507350194613",
"length": 1231.0
},
"deprecated": false,
"id": "CVE-2018-21027-4998b361",
"target": {
"function": "ranges_fixup",
"file": "src/range.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"191044754510389823871595153857608311213",
"251007451156215802987819617303491039146",
"170218499487155182421232840704962225718",
"294520195325905248947529815489493259726",
"16324564127723061873983111124250496937",
"312030142585711592260263598069344961099",
"159175998120829468722174431528435480018",
"86097653126184874518536064721407544351",
"100205047231404715202659932147039334739",
"274313376710733230906520673680043743544",
"267471697226547518199360757118112332962",
"112793034403739440255950804738973970286",
"321962512436979609917862945145478030240",
"281243367339508991182942531202934843209",
"165224509436041067962603035524855325118",
"132461721265789396304322946143784506051",
"86066565936745413437760374599226507353",
"222889396580972607200251280820257946485",
"197534113426348879335693212700507205090",
"61583803937952659494288469190925719379",
"104827655284670312818519699376184679765",
"15466401307158150043810880756350669937",
"339499117373794241587606202869220415003",
"140852171837642838914866257657503643080",
"309016158541236142320567982983504868536",
"220202105381038350125909069951943343735",
"292131424438932285537841277164730664283",
"324612900298354452452440463334660892035",
"201722608717659649125480939654099350133",
"18430708605267062889653387149644856934",
"284935478545849679046904612179059755038",
"52227222965393326464859516234512701336",
"206051557653452169539429320669669427831",
"200380383711336936394806944324723340369",
"81115426428947472311611576544322873872",
"83036811122132361540788595654738059627",
"59589658389896989571694047971344314158",
"211257592938291714369141065993598853856",
"277907599391620034514316244132722163490",
"133586889934318094777894504528451936220",
"189135750645725139649688826906430737707",
"38798964094558076533776888961621536551",
"6992789208830063052050429364632776595",
"102494192698470096532717146937815225926",
"67914805195595504670012849769925422043",
"108315931396396529029764521565812851784",
"131974848651814124745547424687453972948",
"136877921780053333218272647524509427873",
"15044991750241473440670789919721206545",
"95199155751516502331945039617252752345",
"210469514891529954222963193465483997476",
"80484821437998918860236228589026873238",
"212309236568868520391225556103097923776",
"332516965617671605996745122565700595843",
"109817625646331892696856369447701901202",
"293232361697028745037216243119319089884",
"129400911363356136524851968741275469208",
"147800748101869999635167658904914670508",
"201014330209870920183807436234613158560",
"60047520732527610481110202142711718460",
"102959353896279332764977704230906569633",
"23954193411558422146223385308260688918",
"72858027823718924160427887091918718231",
"226468578990915187572802400004456298124",
"188142956810625593885994386823141792945",
"189225615907355822501144031212785825762",
"334247310791093823211403953304930378636",
"332933640775675981990220602083609294337",
"78023284835213616185103901878430025035",
"7474707375940978020050461544446778515",
"328607621134601827114646574726573978691",
"170544129220067324244119225109722291158",
"105763686501570935230127901584020166890",
"107958616903134271309311089338457752777"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-4af46b78",
"target": {
"file": "src/boa.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"158729894522543271203206778134314103178",
"228034807357028361423178602232621717472",
"224830679840791847217646443069108402211",
"59937836320046364318648575719924334066",
"92635375745305131488916742183724300597",
"251985122330190922097183100326031877703",
"141609974105254923510044078053690299967",
"64329899242050754524683153945749255982",
"291125172570132235275522650042237317098",
"48933605466758498276664221696162874081",
"309839541825917609747918842157099297514",
"282130218536764059776870322630341446733",
"49433988428355063692839009775424793880",
"32935165991835627634260262565600242700",
"209106178680531970798507550607663531759",
"157364587726694392653275088451115934329"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-5018ffcc",
"target": {
"file": "src/sublog.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "320839486294719775777298607872633990743",
"length": 760.0
},
"deprecated": false,
"id": "CVE-2018-21027-5451e639",
"target": {
"function": "req_write",
"file": "src/buffer.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"168342482092698679584726796684199284612",
"228498918280931789961563043099657763022",
"160268451546450575596014491703652119934",
"303173799533142637606958294897970820245",
"194140490642489669817555150231333600418",
"330828389521657132615580306554193270040",
"221442077980976988501997262275617085193",
"117955564547163503338901424995187618539",
"194748509024105564783673852434180696264",
"275928861566576737665195209902926647029",
"181109002378721135312090562065191853488",
"221488901029067841994585691522370194542",
"11920034710618647650197071984884244826",
"56853803621212859023730572570931235599",
"329846982022133628698848203497756834882",
"274222018127144154752336869165040435075",
"161526116896223547736576465576862647982",
"115821334131934287438672143654529751672",
"206123134087855743067837174858660681731",
"10316810131229509003868650923305266489",
"61182944053723095671076535167138322851",
"177979865522344647629550068499129533631",
"6252373942245610372887152257211722842",
"128562999733474913586859858238947632881",
"278857267315710961684277843576355065012",
"264773299329241148008650822664045757277",
"29394710368613445367164102658455295465",
"107652043447867534874475347268162110447",
"20902123928331943517725690464976654051",
"191160491490120893298281198830913111359",
"50935748099099239198188725939989326465",
"197109452123174724050522139911209140549",
"273970915825773747826454250176528545462",
"135437754797823377596549458820466760099",
"93659294753907442054042409853082602567",
"4695744231841561937813546391967418158",
"23163987738071770711662483281248402297",
"50405180234411593251108135188811712132",
"229108313439616674059546669372909305246",
"459629889280033892903589719178762330",
"188425762315965461961376712423588808313",
"206851439523078575122124533119911379820",
"316344271060954891375530392192301375301",
"97190465503637019560191663023375872161",
"42290781364820481181959801302409300875",
"205862329537767815557725180947697076566",
"59542976224244810103169411043452356952",
"88830742578205972849726067338648905731",
"119136457930881262414893346492479581320",
"265903612234349772391368719163032496771",
"101135111194559189312832192999352526126",
"305151003480957185480057195636297720048",
"246850117746803210780084981358001589517",
"298478943189000671924044060588281111516",
"44251901906792703676716348572817156358",
"312051900732645182102974041179040479980",
"259419260776583177008669083342314342508",
"41025888085062858845586667862593304924",
"37613456263404467413167792639104727492"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-61d84998",
"target": {
"file": "src/read.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"112746267007681181733909601745987932120",
"230616302462043378676518266591868095180",
"146934030982588350304508974106075038766",
"274071363809798396808700253340842273807",
"88742460128570135626103986075864914134",
"270871587214525742282658111214251970732",
"161260763803986472836126764768058156662",
"32188066220881073643047324675110208019",
"157659467499986251763986166164874673922",
"83156152796814514112265682012155930206",
"126102452062953866726687052083373535119",
"305512272601535294754032335329631150040",
"94520971332246247249471004719695419504"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-6c004df4",
"target": {
"file": "src/request.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "85920654455626937844995460953659117526",
"length": 503.0
},
"deprecated": false,
"id": "CVE-2018-21027-72da8142",
"target": {
"function": "get_alias_hash_value",
"file": "src/alias.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "266103530113105527454377046919292807072",
"length": 1949.0
},
"deprecated": false,
"id": "CVE-2018-21027-760906af",
"target": {
"function": "range_parse",
"file": "src/range.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "282876725592708722696313489809165707922",
"length": 3609.0
},
"deprecated": false,
"id": "CVE-2018-21027-8494f44f",
"target": {
"function": "get_request",
"file": "src/request.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "308687548679789815274005952759622001910",
"length": 448.0
},
"deprecated": false,
"id": "CVE-2018-21027-859d0b85",
"target": {
"function": "open_pipe_fd",
"file": "src/sublog.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "252238033875466294024082993772792915118",
"length": 1164.0
},
"deprecated": false,
"id": "CVE-2018-21027-9092f769",
"target": {
"function": "main",
"file": "src/boa.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"308232103266422108825891107712459373769",
"47939841076745728914238009403740143497",
"294754406696651080282190458753176833354",
"186848873449112250623250980698347428436",
"135666044320536189018656993427854957462",
"246261591752627016388581347547206442831",
"149183839176890687490417252815923546403",
"262193134347759871379199725973043793764",
"207981918424567436335694994858934558899",
"58277205519910598872215949949751751640",
"188040744000041572701377444674146524239",
"103266292074662134118226770491979927194",
"190825334609571490413080208190048910444",
"188040744000041572701377444674146524239",
"103266292074662134118226770491979927194",
"190825334609571490413080208190048910444"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-aa167435",
"target": {
"file": "src/alias.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"90633165510772272901082066432397497940",
"317694287111012345122889547768044236104",
"110687070051990022979792802942260733762",
"281121809564986436355056427003265591885",
"176923426849730728696550743150061701648",
"149840433563510279176206373803060874919",
"257750928831536605130994189131578812024",
"165785786842941413735251399929763818582",
"217029928180700478449742429193933912411"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-b64fddcd",
"target": {
"file": "src/mmap_cache.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "340163824190887113542576351965610880142",
"length": 761.0
},
"deprecated": false,
"id": "CVE-2018-21027-b69b921e",
"target": {
"function": "write_from_pipe",
"file": "src/pipe.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "339455900659938164395849729926779940149",
"length": 4655.0
},
"deprecated": false,
"id": "CVE-2018-21027-b75d29d2",
"target": {
"function": "read_header",
"file": "src/read.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"62298524673907012560609452708193506860",
"4953011461453648411833966101243782959",
"16801057236119515358987209721188142379",
"175071811363975135174607672306634945724",
"250427732829577038888708683996496707599"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-ba57d4d1",
"target": {
"file": "src/signals.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "328266317285794083273437280620689149867",
"length": 629.0
},
"deprecated": false,
"id": "CVE-2018-21027-bd83174e",
"target": {
"function": "open_net_fd",
"file": "src/sublog.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"127138678361347787723529114776411599742",
"70116752152036280637390407027002873749",
"210566312119249204491899646859449487815",
"24402445115991109207981430609445815739",
"333432284930895693019439460487156189954",
"6325379477154338130434219963651157669",
"182193673239305948558578786474912296581",
"105498221660914536524797984194253136457",
"318672384800710484064827289050268783944",
"148447911673073673875853279445928343775"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-c2c488d8",
"target": {
"file": "src/config.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"333431822516599253409820358587994525057",
"142815111031042346734116079187263649788",
"175788308774981702483420453200079818231",
"38552940338332518968873559175270225517",
"5321775106783954256111391970070875022",
"243208533652987941828195875213285965295",
"177091778909474936140389064802457296590",
"198983023572269062785510775017516443699",
"87624299100992607312615603336041330532",
"241853877135161875702689452634333723827",
"266495762915826498564163465828715301027",
"4157087087201068864385307830572991893",
"300905757626039613969842718675776276895",
"76817873333124987621702217174665048104",
"307751414765800461345641793823509900058",
"257863625702094523736377401342458947864",
"214764810003580491779929974476295547296",
"21754069933020772267740227354757684914",
"316028626596887107796418772086158058950",
"114203055274522557928581146174805436851",
"160300710175378443103423532741332644699",
"23579110590783684759804195513860822543",
"110917193211843570577672888732138821683",
"178910204962482100847587791572455115011",
"80706097667322835513337773491262287617",
"152841230034429271071814584449721430422",
"125834901395992872263876511753162006844",
"245850286031037017990504970156132540078",
"34954792344692880190784247377732761976",
"307073830809166873721137428887895778254",
"238086986141511334864663527761830382925"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-d2529f2e",
"target": {
"file": "src/index_dir.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"326782391088866303498527234350665926698",
"206544563054418567451902914031678711978",
"300140412441558584687942778965284744900",
"280413521338662130955804462924013017858",
"25315663787870576932773530527312309845"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-e2818ef9",
"target": {
"file": "src/globals.h"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"195320847760242880543437940270345329103",
"289801243460939303190330859008917431280",
"195695343851913820942238590023425341450",
"185010443355613203047031292409075656081",
"150163089017976250444294826240463969130"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-e4ce321d",
"target": {
"file": "src/util.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "201361996687462865407845143075954242524",
"length": 895.0
},
"deprecated": false,
"id": "CVE-2018-21027-ea3f1b16",
"target": {
"function": "io_shuffle_sendfile",
"file": "src/pipe.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"221008766272850137858545975885998584342",
"96809849929446320530641793182308408451",
"44911850794202664653107308204912626149",
"62639656446822658727345576824164256404",
"171909518342492233381470129626936190709"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2018-21027-ef8e6322",
"target": {
"file": "src/buffer.c"
}
},
{
"source": "https://github.com/gpg/boa/commit/7d0aa0391a30625856398a49e6a42342e2d14e4b",
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "322880290038542073295904244075497764188",
"length": 2018.0
},
"deprecated": false,
"id": "CVE-2018-21027-f1f20560",
"target": {
"function": "read_config_files",
"file": "src/config.c"
}
}
]
vanir_signatures_modified
"2026-07-08T19:45:30Z"
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-21027.json"