CVE-2018-1000886

{"id": "CVE-2018-1000886", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2018-12-20T21:29:00.447", "references": [{"url": "https://bugzilla.nasm.us/show_bug.cgi?id=3392514", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "nasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vulnerability in asm/stdscan.c:130 that can result in Stack-overflow caused by triggering endless macro generation, crash the program. This attack appear to be exploitable via a crafted nasm input file."}, {"lang": "es", "value": "nasm, en versiones 2.14.01rc5 y 2.15, contiene una vulnerabilidad de desbordamiento de b\u00fafer en asm/stdscan.c:130 que puede resultar en un desbordamiento de b\u00fafer basado en pila, provocado por la generaci\u00f3n infinita de macros, que provoca el cierre inesperado del programa. Este ataque parece ser explotable mediante un archivo de entradas nasm manipulado."}], "lastModified": "2019-02-01T16:41:04.787", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nasm:netwide_assembler:2.14.01rc5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F001C6F-A818-4D70-9106-0B2D0CB3EE28"}, {"criteria": "cpe:2.3:a:nasm:netwide_assembler:2.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4E1B969-F71C-4770-B43C-C173D45C379F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}