PT-2018-2598 · Libcaca+2 · Libcaca+2

Fgeeko · Publicado 2018-11-22 · Atualizado 2025-01-13 · CVE-2018-20546

Positive Technologies (AI Summary)

CVSS v2.0

8.8

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions libcaca version 0.99.beta19

Description The issue is related to an integer overflow in the get rgba default function of the libcaca graphic library, located in caca/dither.c. This can lead to an illegal READ memory access, potentially allowing a remote attacker to gain unauthorized access to protected information.

Recommendations For libcaca version 0.99.beta19, consider restricting access to the get rgba default function in caca/dither.c as a temporary workaround until a patch is available.

Exploit

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

BDU:2019-01074

CVE-2018-20546

DLA-1631-1

MGASA-2019-0050

OPENSUSE-SU-2019:1144-1

OPENSUSE-SU-2019_1144-1

OPENSUSE-SU-2024:10927-1

ROSA-SA-2025-2554

SUSE-SU-2019:0770-1

SUSE-SU-2019:2745-1

SUSE-SU-2019:2745-2

USN-3860-1

USN-3860-2

Produtos afetados

Suse

Ubuntu

Libcaca

Referências · 58

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1652622 · Exploit
• https://github.com/cacalabs/libcaca/commit/1022d97496c7899e8641515af363381b31ae2f05 · Correção
• https://github.com/cacalabs/libcaca/issues/38 · Nota
• https://suse.com/security/cve/CVE-2021-3410 · Nota
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-security-announce/2019-04/msg00033.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-20546 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-20549 · Nota
• https://bugzilla.suse.com/1120584 · Nota
• https://usn.ubuntu.com/3860-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:2745-2 · Aviso do Fabricante
• https://usn.ubuntu.com/3860-2 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-20546 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2019:0770-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-20544 · Nota