TI-2018-14210 Aliases CVE-2018-20032 GHSA-3fmw-2235-q93p

A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon…

LOW 37Published 2019-03-21 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon to stop, and the vendor daemon to shut down.

Why it matters now

EPSS 0.02242 82nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Flexera Software LLC	FlexNet Publisher	up to 11.16.1.0	—	No fix listed	CNA

FlexNet Publisher VendorFlexera Software LLC Affected up to 11.16.1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:flexera:flexnet_publisher::::::::	up to 11.16.1.0	Vulnerable	Flexera
cpe:2.3:a:oracle:communications_lsms::::::::	13.1 – 13.4	Vulnerable	Oracle

cpe:2.3:a:flexera:flexnet_publisher:*:*:*:*:*:*:*:* Versions up to 11.16.1.0 Vulnerable ·Flexera
cpe:2.3:a:oracle:communications_lsms:*:*:*:*:*:*:*:* Versions 13.1 – 13.4 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-20032
2026-10-03 Alias added: GHSA-3fmw-2235-q93p

References

Patch 1

https://www.oracle.com/security-alerts/cpuoct2021.html

Advisory 1

https://secuniaresearch.flexerasoftware.com/advisories/85979/

TI-2011-03652 Multiple directory traversal vulnerabilities in lmgrd in Flexera FlexNet Publisher 11.10… CVSS 2.0HIGH 10.0
TI-2015-06818 Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher… CVSS 3.0CRITICAL 9.8
TI-2019-15367 FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin) CVSS 4.0MEDIUM 5.1
TI-2011-03651 Heap-based buffer overflow in lmadmin in Flexera FlexNet Publisher 11.10 (aka FlexNet… CVSS 2.0HIGH 10.0
TI-2018-14211 Resource allocation without limits in Flexera Software LLC FlexNet Publisher CVSS 3.1CRITICAL 9.8
TI-2017-04623 Out-of-bounds write in Flexera Software LLC GnuTLS libtasn1 CVSS 3.1HIGH 8.8

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences