1957: 2018 CVE List - Revision history

Ardub: /* Explanation */ Link to 424, which has a similar list of vulnerabilities

2026-05-15T02:29:05Z

‎Explanation: Link to 424, which has a similar list of vulnerabilities

2001:E68:541F:1F02:54E:6269:6584:21AA at 09:30, 31 December 2025

2025-12-31T09:30:13Z

97.64.62.188: update

2025-12-19T15:54:17Z

update

FaviFake at 16:51, 2 March 2025

2025-03-02T16:51:02Z

162.158.178.172 at 00:59, 24 February 2025

2025-02-24T00:59:17Z

172.71.147.128: /* Explanation */ Better wording

2024-11-11T04:57:29Z

‎Explanation: Better wording

CategoryGeneral: Language

2024-10-26T09:19:53Z

Language

172.70.162.2: /* Explanation */ punc (+case)

2024-10-18T19:16:37Z

‎Explanation: punc (+case)

162.158.41.134: /* Explanation */ {{citation needed}}

2024-10-18T17:27:43Z

‎Explanation: {{citation needed}}

172.70.91.89: Undo revision 344580 by 172.70.143.126 (talk) Joke link was mistaken for spam (and not properly removed, in any case).

2024-06-19T12:56:50Z

Undo revision 344580 by 172.70.143.126 (talk) Joke link was mistaken for spam (and not properly removed, in any case).

@@ Line 10: / Line 10: @@
 {{w|Common Vulnerabilities and Exposures|CVE}} (Common Vulnerabilities and Exposures) is a standardized format for assigning an identity to a cybersecurity vulnerability (similar to the way that astronomical bodies are assigned unique identifiers by committees). Giving vulnerabilities a unique identifier makes them easier to talk about and helps in keeping track of the progress made toward resolving them. The typical format of a CVE identifier is '''CVE-[YEAR]-[NUMBER]'''. For example, the CVE identifier for 2017's widespread {{w|Meltdown (security vulnerability)|Meltdown vulnerability}} is [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754 CVE-2017-5754]. CVEs also contain a short description of the issue.
-In this comic (released in February 2018), Randall presents a number of spurious predicted CVEs for later in 2018. Each CVE identifier is given as "CVE-2018-?????", reflecting the fact that they have not yet happened so we don't know exactly what their CVE identifier will be. He has previously referenced diacritics in [[1647: Diacritics]]. Bruce Schneier was previously mentioned in the title texts of [[748: Worst-Case Scenario]] and [[1039: RuBisCO]]. Here are short descriptions of all the vulnerabilities mentioned in the comic:
+In this comic (released in February 2018), Randall presents a number of spurious predicted CVEs for later in 2018. Each CVE identifier is given as "CVE-2018-?????", reflecting the fact that they have not yet happened so we don't know exactly what their CVE identifier will be. A similar list of tech vulnerabilities appeared in [[424: Security Holes]]. Randall has previously referenced diacritics in [[1647: Diacritics]]. Bruce Schneier was previously mentioned in the title texts of [[748: Worst-Case Scenario]] and [[1039: RuBisCO]]. Here are short descriptions of all the vulnerabilities mentioned in the comic:
 ;Apple products crash when displaying certain {{w|Telugu language|Telugu}} or {{w|Bengali language|Bengali}} letter combinations.

@@ Line 28: / Line 28: @@
+:
 :This CVE presents the less-threatening reverse situation: allowing a root user to ''de-escalate'' to normal account privileges. In fact, root users can already do this at any time; superuser privileges allow them to take control of any user account, so they can simply switch to an account which has fewer privileges than the root user.
 ;Apple products catch fire when displaying emoji with diacritics.
 :This is a reference to a common problem of modern gadgets catching fire (usually related to flaws in lithium-ion batteries), as well as to Apple products crashing when attempting to display certain character sequences. Diacritics are the accents found on letters in some languages, for example the German {{w|Umlaut_(diacritic)|umlaut}} (ü) or the French {{w|cedilla}} (ç). They usually indicate a change to how the letter is pronounced. Diacritics are not normally found on emojis,{{Citation needed}} but since emojis are part of the widely-used {{w|Unicode}} standard which also allows for combining diacritics, it is in fact possible to combine the two to create a diacritical emoji. 🔥̃ is such an example.

@@ Line 23: / Line 23: @@
 :Describes a common feature on news sites or social media sites like Facebook. The possibility for users to "inject" text into the page is by design. This is a humorous reference to the relatively common security vulnerability "[[Wikipedia:Cross-site_scripting|persistent cross-site scripting]]", where input provided by a user, such as through a comment section, can result in dangerous content containing arbitrary HTML or JavaScript code being displayed to other users.
 ;MySQL server 5.5.45 secretly runs two parallel databases for people who say "S-Q-L" and "sequel."
-:Some people pronounce "{{w|SQL}}" like "sequel", after SQL's predecessor "SEQUEL (Structured English Query Language)". The standard for SQL suggests that it should be pronounced as separate letters; however, the author of SQL pronounces it "sequel", so the debate persists (with even <s>more</s> <s>less</s> <s>more</s> <s>less</s> <s>MORE</s> justification than arguments about how to pronounce "GIF"{{Citation needed}}). MySQL is an free relational database management system. The latest generally available version (at the time of writing) is MySQL 5.7.
+:Some people pronounce "{{w|SQL}}" like "sequel", after SQL's predecessor "SEQUEL (Structured English Query Language)". The standard for SQL suggests that it should be pronounced as separate letters; however, the author of SQL pronounces it "sequel", so the debate persists (with even <s>more</s> <s>less</s> <s>more</s> <s>less</s> <s>MORE</s> justification than arguments about how to pronounce "GIF"{{Citation needed}}). MySQL is an free relational database management system. The latest generally available version (at the time of writing) is MySQL 8.0.44.
 ;A flaw in some x86 CPUs could allow a root user to de-escalate to normal account privileges.
 :{{w|Privilege escalation}} refers to any illegitimate means by which a system user gains greater access privileges than they are supposed to have. The most highly-sought privilege is that of the root user, which allows complete access to an entire system&mdash; a ''superuser''. Any flaw that would allow an ordinary user to escalate to superuser status is a critical security threat, as they then have full control of the machine. This is what most crackers seek to achieve when attacking a device.

@@ Line 10: / Line 10: @@
 {{w|Common Vulnerabilities and Exposures|CVE}} (Common Vulnerabilities and Exposures) is a standardized format for assigning an identity to a cybersecurity vulnerability (similar to the way that astronomical bodies are assigned unique identifiers by committees). Giving vulnerabilities a unique identifier makes them easier to talk about and helps in keeping track of the progress made toward resolving them. The typical format of a CVE identifier is '''CVE-[YEAR]-[NUMBER]'''. For example, the CVE identifier for 2017's widespread {{w|Meltdown (security vulnerability)|Meltdown vulnerability}} is [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5754 CVE-2017-5754]. CVEs also contain a short description of the issue.
-In this comic (released in February 2018), Randall presents a number of spurious predicted CVEs for later in 2018. Each CVE identifier is given as "CVE-2018-?????", reflecting the fact that they have not yet happened so we don't know exactly what their CVE identifier will be.
+In this comic (released in February 2018), Randall presents a number of spurious predicted CVEs for later in 2018. Each CVE identifier is given as "CVE-2018-?????", reflecting the fact that they have not yet happened so we don't know exactly what their CVE identifier will be. He has previously referenced diacritics in [[1647: Diacritics]]. Bruce Schneier was previously mentioned in the title texts of [[748: Worst-Case Scenario]] and [[1039: RuBisCO]]. Here are short descriptions of all the vulnerabilities mentioned in the comic:
 ;Apple products crash when displaying certain {{w|Telugu language|Telugu}} or {{w|Bengali language|Bengali}} letter combinations.
@@ Line 97: / Line 95: @@
 ==Trivia==
+The word "exploit" in the second line is misspelled. This hasn't been fixed.
 {{comic discussion}}

← Older revision		Revision as of 00:59, 24 February 2025
Line 112:		Line 112:
	[[Category:Computers]]		[[Category:Computers]]
	[[Category:iOS]]		[[Category:iOS]]
		+	[[Category:Emoji]]

@@ Line 41: / Line 41: @@
 :[[wikipedia:Hypervisor|"Hypervisors"]] are a tool for computer virtualization. Virtualization is implemented via various combinations of hardware and/or software, which requires a computer to completely simulate another computer, with its own unique hardware and software, and to varying degrees as to whether or not the virtualization is aware of or can determine whether it is being virtualized. Many IT professionals and businesses rely heavily on various forms of virtualization, but most of the individual employees would be hard-pressed to explain how it works. Programs running on other virtual computers, or on the real computer, may be able to access information on a virtual computer in ways which would not be possible with a single real computer. Consequently, understanding how the hypervisor works is important to assessing the security of a virtual server. Meltdown and Spectre are related to this.
 ;Critical&#x3A; Under Linux 3.14.8 on System/390 in a UTC+14 time zone, a local user could potentially use a buffer overflow to change another user's default system clock from 12-hour to 24-hour.
-:This joke is about arcane systems that are running Linux in exceedingly rare situations, meaning that reproducing errors would be incredibly difficult or inconvenient, and would only affect a very tiny user base (if any at all). {{w|IBM System/390 ES/9000 Enterprise Systems Architecture ESA family|System/390}} is an IBM mainframe introduced almost 30 years before this comic, which has a version of Linux. UTC+14 is a time zone used only on some islands in the Pacific Ocean (Primarily [[Wikipedia:Line_Islands|the Line Islands]]) and is also the earliest time zone on Earth. Even if all of these absurd conditions were met, the resulting vulnerability would still be relatively benign: simply changing a user's preferred clock display format. Other xkcd comics make references to such obscure computer-time issues relating to time zones and time conversions, and how many programmers find these issues frustrating or even traumatizing.
+:The humor from this CVE comes from the fact that, despite being marked as critical, it is a difficult-to-achieve exploit for a minor effect. {{w|IBM System/390 ES/9000 Enterprise Systems Architecture ESA family|System/390}} is an IBM mainframe introduced almost 30 years before this comic. Version 3.14.8 of the Linux kernel was released in June of 2014, four years before the comic. UTC+14 is a time zone used only on some islands in the Pacific Ocean (Primarily [[Wikipedia:Line_Islands|the Line Islands]]) and is also the earliest time zone on Earth. Even if all of these absurd conditions were met, an arcane system running an obsolete version of Linux in an uncommon time zone, the resulting vulnerability would still be relatively benign: simply changing a user's preferred clock display format. Other xkcd comics make references to such obscure computer-time issues relating to time zones and time conversions, and how many programmers find these issues frustrating or even traumatizing.
 ;x86 has way too many instructions.
 :The x86 architecture (used in many Intel and AMD processors) is very complicated.{{Citation needed}} Processors typically implement such a complex architecture using programs (microcode) run on a set of hidden, proprietary processors. The details of these hidden machines and errors in the microcode can result in security vulnerabilities, such as Meltdown, where the physical machine does not match the conceptual machine.

@@ Line 32: / Line 32: @@
 ;Apple products catch fire when displaying emoji with diacritics.
 :This is a reference to a common problem of modern gadgets catching fire (usually related to flaws in lithium-ion batteries), as well as to Apple products crashing when attempting to display certain character sequences. Diacritics are the accents found on letters in some languages, for example the German {{w|Umlaut_(diacritic)|umlaut}} (ü) or the French {{w|cedilla}} (ç). They usually indicate a change to how the letter is pronounced. Diacritics are not normally found on emojis,{{Citation needed}} but since emojis are part of the widely-used {{w|Unicode}} standard which also allows for combining diacritics, it is in fact possible to combine the two to create a diacritical emoji. 🔥̃ is such an example.
 ;An oversight in the rules allows a dog to join a basketball team.
 :This probably refers to the movie ''{{w|Air Bud}}'', about a dog playing basketball. This has been a common theme in xkcd comics: see [[115: Meerkat]], [[1439: Rack Unit]], [[1819: Sweet 16]], [[1552: Rulebook]].
@@ Line 107: / Line 108: @@
 [[Category:Comics with lowercase text]]
 [[Category:Charts]]
 [[Category:Programming]]
 [[Category:Computers]]
 [[Category:iOS]]

@@ Line 42: / Line 42: @@
 :This joke is about arcane systems that are running Linux in exceedingly rare situations, meaning that reproducing errors would be incredibly difficult or inconvenient, and would only affect a very tiny user base (if any at all). {{w|IBM System/390 ES/9000 Enterprise Systems Architecture ESA family|System/390}} is an IBM mainframe introduced almost 30 years before this comic, which has a version of Linux. UTC+14 is a time zone used only on some islands in the Pacific Ocean (Primarily [[Wikipedia:Line_Islands|the Line Islands]]) and is also the earliest time zone on Earth. Even if all of these absurd conditions were met, the resulting vulnerability would still be relatively benign: simply changing a user's preferred clock display format. Other xkcd comics make references to such obscure computer-time issues relating to time zones and time conversions, and how many programmers find these issues frustrating or even traumatizing.
 ;x86 has way too many instructions.
-:The x86 architecture (used in many Intel and AMD processors) is very complicated. Processors typically implement such a complex architecture using programs (microcode) run on a set of hidden, proprietary processors. The details of these hidden machines and errors in the microcode can result in security vulnerabilities, such as Meltdown, where the physical machine does not match the conceptual machine.
+:The x86 architecture (used in many Intel and AMD processors) is very complicated {{citation needed}}. Processors typically implement such a complex architecture using programs (microcode) run on a set of hidden, proprietary processors. The details of these hidden machines and errors in the microcode can result in security vulnerabilities, such as Meltdown, where the physical machine does not match the conceptual machine.
+:
 :A more complicated instruction set is more complex to implement.{{Citation needed}} The x86 architecture is considered "CISC" (a "{{w|Complex instruction set computer}}"), having many instructions originally provided to make programming by a human simpler; other examples include the 68000 series used in the first {{w|Apple Macintosh}}. In the 1980s, this design philosophy was countered by the "RISC" ("{{w|Reduced instruction set computer}}") design movement - based on the observation that computer programs were increasingly generated by compilers (which only used a few instructions) rather than directly by people, and that the chip area dedicated to extra instructions could be better dedicated to, for example, cache. Examples of RISC style designs include {{w|SPARC}}, {{w|MIPS}}, {{w|PowerPC}} (used by Apple in later Macintoshes) and the {{w|ARM architecture|ARM}} chips common in mobile phones. Historically, there was considerable discussion about the merits of each approach. At one time the Mac and Windows PC were on different sides; owners of other competing systems such as the Archimedes and Amiga had similar arguments on usenet in the early 1990s. This "issue" may be posted by someone who still recalls these debates. Technically, the extra instructions do slightly complicate the task of validating correct chip behavior and complicate the tool chains that manage software, which could be seen as a minor security risk. However, the 64-bit architecture introduced by {{w|AMD}}, and since adopted by {{w|Intel}}, does rationalize things somewhat, and all recent x86 chips break down instructions into RISC-like micro-operations, so the complication from a hardware perspective is localized. Recent security issues, such as the speculative cache load issue in Meltdown and Spectre, depend more on details of implementation, rather than instruction set, and have been exhibited both by x86 (CISC) and ARM (RISC) processors.

@@ Line 64: / Line 64: @@
 ;Turns out the cloud is just other people's computers.
 :Cloud computing is a system of networked computers wherein the client user's computer can offload some of its work load and storage to the other computers &mdash; known as "the cloud." Many businesses offer their networks for consumer use, and can be marketed as "{{w|Platform as a Service}}" ("PaaS") or simply "cloud service." As with any product companies are always tempted to overhype what they offer, promising cloud computing to be more powerful and wondrous than it actually is. Thus, protestors try to remind people what cloud services really are by referring to "the cloud" as "other people's computers." This is, at its core, entirely accurate, taking away the business jargon and simplifying the situation in such a way that it might cast doubt on the security, reliability, and general effectiveness of using "cloud" solutions.  In [[908: The Cloud]], it turns out that [[Black Hat]] is the "other people" whose computer ''is'' the Cloud.
-;A flaw in Mitre's CVE database allows arbitrary code insertion.[[779|
+;A flaw in Mitre's CVE database allows arbitrary code insertion.[[779|[~~CLICK HERE FOR CHEAP VIAGRA~~]]]
 :Mitre's CVE database is where all {{w|Common Vulnerabilities and Exposures|CVEs}} are stored. This log message forms the punchline of the comic, as it implies that all of the exaggerated error messages above might have been inserted by crackers exploiting the vulnerability. To pour salt in the wound, they then included in a typical spam link purporting to offer inexpensive {{w|Viagra|brand-name Sildenafil}}.
 ;It turns out Bruce Schneier is just two mischevious kids in a trenchcoat.