PT-2018-18369 · Mozilla+3 · Graphite 2+3

Gsharpsh00Ter · Publicado 2018-03-09 · Atualizado 2024-06-15 · CVE-2018-7999

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: graphite2 version 1.3.11

Description: A NULL pointer dereference issue was discovered in Segment.cpp during a dumbRendering operation. This may allow attackers to cause a denial of service or possibly have other unspecified impacts via a crafted .ttf file.

Recommendations: For graphite2 version 1.3.11, consider avoiding the use of crafted .ttf files until a patch is available. As a temporary workaround, restrict access to the dumbRendering operation in Segment.cpp to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2018-2169

CVE-2018-7999

MGASA-2018-0240

OPENSUSE-SU-2024:10820-1

SUSE-SU-2018:0858-1

SUSE-SU-2018_0858-1

USN-5657-1

Produtos afetados

Alt Linux

Suse

Ubuntu

Graphite 2

Referências · 23

• 🔥 https://github.com/silnrsi/graphite/issues/22 · Exploit
• https://github.com/silnrsi/graphite/commit/db132b4731a9b4c9534144ba3a18e65b390e9ff6 · Correção
• https://osv.dev/vulnerability/CVE-2018-7999 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7999 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=22880 · Nota
• https://suse.com/support/update/announcement/2018/suse-su-20180858-1 · Nota
• https://suse.com/security/cve/CVE-2018-7999 · Nota
• https://osv.dev/vulnerability/MGASA-2018-0240 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-7999 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-updates/2018-04/msg00002.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7999 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2018:0858-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7999 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-5657-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-7999 · Nota de Segurança