CVE-2018-8754

Опубликовано: 18 мар. 2018

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub

Ссылки

https://github.com/libyal/libevt/commit/9d2cc3ca0a1612a6b271abcacffc2e3eea42925e
Patch
Vendor Advisory
https://www.debian.org/security/2018/dsa-4160
Third Party Advisory
https://github.com/libyal/libevt/commit/9d2cc3ca0a1612a6b271abcacffc2e3eea42925e
Patch
Vendor Advisory
https://www.debian.org/security/2018/dsa-4160
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:libevt_project:libevt:*:*:*:*:*:*:*:*

Версия до 20180317 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 16%

0.0005

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2018-8754

CVSS3: 5.5

ubuntu

почти 8 лет назад

CVE-2018-8754

CVSS3: 5.5

debian

почти 8 лет назад

The libevt_record_values_read_event() function in libevt_record_values ...

GHSA-hcvj-rqwj-4h7f

CVSS3: 5.5

github

больше 3 лет назад

** DISPUTED ** The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub.

EPSS

Процентиль: 16%

0.0005

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-125