PT-2018-13934 · Nmealib · Nmealib

Tr3E · Published 2018-09-21 · Updated 2020-08-24 · CVE-2018-17174

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nmealib version 0.5.3

Description A stack-based buffer overflow was discovered in the nmealib library, specifically in the nmea parse() function in parser.c. This issue allows an attacker to trigger denial of service, and potentially arbitrary code execution in certain contexts, by providing malformed data to a product that uses this library.

Recommendations For version 0.5.3, consider restricting the use of the nmea parse() function until a patch is available to prevent potential exploitation. Additionally, ensure that all data parsed by this function is thoroughly validated to minimize the risk of denial of service or arbitrary code execution.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-17174

Affected Products

Nmealib

References · 3

• 🔥 https://cnblogs.com/tr3e/p/9662324.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17174 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17174 · Vendor Advisory