PT-2018-10524 · R Core Team+1 · Haven R Package+1

Published 2018-05-22 · Updated 2023-10-05 · CVE-2018-11365

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ReadStat version 0.1.1 haven R package (affected versions not specified)

Description The issue involves an infinite loop condition, a memory leak associated with an iconv open call, and a heap-based buffer over-read via an unterminated string. This could lead to Denial of Service or other undefined behaviors.

Recommendations For ReadStat version 0.1.1, update to a version that fixes the infinite loop in sas/readstat sas7bcat read.c. For the haven R package, consider restricting the use of the underlying ReadStat library until a patch is available. As a temporary workaround, consider disabling the iconv open call to minimize the risk of memory leaks. Avoid using unterminated strings in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability in the haven R package.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2018-11365

RSEC-2023-5

Affected Products

Readstat

Haven R Package

References · 13

• 🔥 https://github.com/ChijinZ/security_advisories/tree/master/ReadStat-7bced5b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11365 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-11365 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-11365 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-11364 · Vendor Advisory
• https://osv.dev/vulnerability/RSEC-2023-5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11365 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-11365 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-5698 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-11365 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-11365 · Vendor Advisory
• https://github.com/WizardMac/ReadStat/issues/108 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=899335 · Note