PT-2018-18180 · David Tschumperle · Cimg

Xiaoqx · Publicado 2018-03-02 · Atualizado 2020-11-02 · CVE-2018-7641

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CImg version 220

Description A heap-based buffer over-read issue occurs in the load bmp function in CImg.h when loading a crafted bmp image, specifically in the "32 bits colors" case.

Recommendations For CImg version 220, consider avoiding the use of the load bmp function in CImg.h until a patch is available, or refrain from loading untrusted bmp images to minimize the risk of exploitation.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2018-7641

DLA-1934-1

DLA-2421-1

MGASA-2018-0438

Produtos afetados

Cimg

Referências · 18

• 🔥 https://github.com/dtschump/CImg/issues/185 · Exploit
• https://github.com/dtschump/CImg/commit/10af1e8c1ad2a58a0a3342a856bae63e8f257abb · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7641 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2018-0438 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=23700 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-7641 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7641 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2018-0438.html · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/OCWBP5ZUZHIZXP7IFUEZIJG7Q3VLJXBV · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7641 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html · Nota
• https://osv.dev/vulnerability/DLA-1934-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-2421-1 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6Z4EMB7JFEKIYRFRANRNDD7ZIIZP6T4Z · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-7641 · Aviso do Fabricante