PT-2015-6782 · Github · Redcarpet

Giancarlo Canales Barreto · Published 2015-07-14 · Updated 2018-08-15 · CVE-2015-5147

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Redcarpet versions prior to 3.3.2

Description The issue is a stack-based buffer overflow in the header anchor function within the HTML renderer. This allows attackers to cause a denial of service, potentially leading to a crash, and may also enable the execution of arbitrary code through unspecified vectors.

Recommendations For versions prior to 3.3.2, update to version 3.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the header anchor function in the HTML renderer until a patch is applied.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-5147

GHSA-7322-9MX6-5J2M

Affected Products

Redcarpet

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2015-5147 · Security Note
• https://osv.dev/vulnerability/GHSA-7322-9mx6-5j2m · Vendor Advisory
• https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md · Note
• https://github.com/vmg/redcarpet · Note
• https://github.com/vmg/redcarpet/commit/2cee777c1e5babe8a1e2683d31ea75cc4afe55fb · Note
• http://securityfocus.com/bid/75508 · Note
• http://openwall.com/lists/oss-security/2015/06/29/3 · Note
• https://web.archive.org/web/20150711061256/http://securityfocus.com/bid/75508 · Note
• http://openwall.com/lists/oss-security/2015/06/30/10 · Note