In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.
References
Link | Resource |
---|---|
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA/ | |
https://security.gentoo.org/glsa/202101-24 | Third Party Advisory |
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0531 | Exploit Technical Description Third Party Advisory |
Configurations
History
07 Nov 2023, 02:58
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
03 Feb 2021, 16:42
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:nasa:cfitsio:*:*:*:*:*:*:*:* | |
References | (GENTOO) https://security.gentoo.org/glsa/202101-24 - Third Party Advisory |
26 Jan 2021, 18:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2018-04-16 16:29
Updated : 2023-12-10 12:30
NVD link : CVE-2018-3848
Mitre link : CVE-2018-3848
CVE.ORG link : CVE-2018-3848
JSON object : View
Products Affected
fedoraproject
- fedora
nasa
- cfitsio
CWE
CWE-787
Out-of-bounds Write