PT-2018-13934 · Nmealib · Nmealib

Tr3E · Publicado 2018-09-21 · Atualizado 2020-08-24 · CVE-2018-17174

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nmealib version 0.5.3

Description A stack-based buffer overflow was discovered in the nmealib library, specifically in the nmea parse() function in parser.c. This issue allows an attacker to trigger denial of service, and potentially arbitrary code execution in certain contexts, by providing malformed data to a product that uses this library.

Recommendations For version 0.5.3, consider restricting the use of the nmea parse() function until a patch is available to prevent potential exploitation. Additionally, ensure that all data parsed by this function is thoroughly validated to minimize the risk of denial of service or arbitrary code execution.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2018-17174

Produtos afetados

Nmealib

Referências · 3

• 🔥 https://cnblogs.com/tr3e/p/9662324.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17174 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17174 · Aviso do Fabricante