PT-2018-2298 · Little Cms+4 · Little Cms+4

Quang Nguyen · Publicado 2018-08-14 · Atualizado 2024-06-15 · CVE-2018-16435

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Little CMS version 2.9

Description The issue is related to an integer overflow in the AllocateDataSet function in cmscgats.c, which leads to a heap-based buffer overflow in the SetData function. This can be triggered via a crafted file passed as the second argument to cmsIT8LoadFromFile, potentially allowing a remote attacker to cause a denial of service or execute arbitrary code.

Recommendations For Little CMS version 2.9, consider disabling the AllocateDataSet function or restricting the use of cmsIT8LoadFromFile until a patch is available to prevent potential exploitation.

Exploit

Correção

Memory Corruption

Integer Overflow

Enumeração de Fraquezas

CWE-787

CWE-190

Identificadores relacionados

ALT-PU-2020-2055

AZL-44076

BDU:2019-00426

CVE-2018-16435

DLA-1496-1

DSA-4284-1

DSA-4289-1

MGASA-2018-0387

OPENSUSE-SU-2018_3529-1

OPENSUSE-SU-2019:0043-1

OPENSUSE-SU-2019_0042-1

OPENSUSE-SU-2019_0043-1

OPENSUSE-SU-2024:10876-1

OPENSUSE-SU-2024:10910-1

RHSA-2018:3004

RHSA-2018_3004

SUSE-SU-2018:3498-1

SUSE-SU-2018:3545-1

SUSE-SU-2018_3498-1

SUSE-SU-2019:0049-1

SUSE-SU-2019:0049-2

SUSE-SU-2019:0057-1

SUSE-SU-2019:0057-2

SUSE-SU-2019:0058-1

USN-3770-1

USN-3770-2

Produtos afetados

Alt Linux

Little Cms

Red Hat

Suse

Ubuntu

Referências · 243

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/chrome_object_create.rb · Exploit
• 🔥 https://github.com/mm2/Little-CMS/issues/171 · Exploit
• 🔥 https://github.com/mmxsrup/CVE-2018-3639 · Exploit
• 🔥 https://github.com/jhalon/CVE-2018-17463 · Exploit
• https://github.com/mm2/Little-CMS/commit/768f70ca405cd3159d990e962d54456773bb8cf8 · Correção
• https://suse.com/security/cve/CVE-2017-10125 · Nota
• https://suse.com/security/cve/CVE-2017-10110 · Nota
• https://suse.com/security/cve/CVE-2016-9843 · Nota
• https://suse.com/security/cve/CVE-2019-7317 · Nota
• https://suse.com/security/cve/CVE-2019-2983 · Nota
• https://suse.com/security/cve/CVE-2017-10357 · Nota
• https://suse.com/security/cve/CVE-2020-14803 · Nota
• https://suse.com/security/cve/CVE-2018-13785 · Nota
• https://osv.dev/vulnerability/ALPINE-CVE-2018-16435 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4284-1 · Aviso do Fabricante