CVE-2018-16948

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.

• CWE-200

• http://openafs.org/pages/security/OPENAFS-SA-2018-002.txtVendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00024.htmlThird Party Advisory
• https://www.debian.org/security/2018/dsa-4302Third Party Advisory
• http://openafs.org/pages/security/OPENAFS-SA-2018-002.txtVendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00024.htmlThird Party Advisory
• https://www.debian.org/security/2018/dsa-4302Third Party Advisory

Published

Sep 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16934Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16935Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16936Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1694IBM Jazz applications (IBM Rational Collaborative Lifecycle …5.9
• CVE-2018-16946LG LNB*, LND*, LNU*, and LNV* smart network camera devices h…
• CVE-2018-16947An issue was discovered in OpenAFS before 1.6.23 and 1.8.x b…
• CVE-2018-16949An issue was discovered in OpenAFS before 1.6.23 and 1.8.x b…
• CVE-2018-1695IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 install…7.3
• CVE-2018-16950Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remo…
• CVE-2018-16951xunfeng 0.2.0 allows command execution via CSRF because mass…
• CVE-2018-16952The Oracle WebCenter Interaction Portal 10.3.3 does not impl…
• CVE-2018-16953The AjaxView::DisplayResponse() function of the portalpages.…