PT-2018-1574 · Netwide+1 · Netwide Assembler+1

Rookie · Published 2018-09-13 · Updated 2020-07-31 · CVE-2018-16999

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netwide Assembler (NASM) version 2.14rc15

Description The issue is related to an invalid memory write in the expand smacro function in preproc.c, which can cause a denial of service. This is due to errors in memory deallocation. Attackers can exploit this by providing a crafted input file, leading to a segmentation fault. The estimated number of potentially affected devices is not specified.

Recommendations For Netwide Assembler (NASM) version 2.14rc15, consider avoiding the use of the expand smacro function in preproc.c until a patch is available. As a temporary workaround, restrict the input files to prevent crafted files from being processed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Improper Resource Release

Weakness Enumeration

CWE-787

CWE-404

Related Identifiers

BDU:2018-01131

CVE-2018-16999

MGASA-2020-0303

OPENSUSE-SU-2020:0952-1

OPENSUSE-SU-2020:0954-1

OPENSUSE-SU-2020_0952-1

OPENSUSE-SU-2020_0954-1

SUSE-SU-2020:1843-1

Affected Products

Netwide Assembler

Suse

References · 50

• 🔥 https://bugzilla.nasm.us/show_bug.cgi?id=3392508 · Exploit
• https://ubuntu.com/security/CVE-2018-16999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16999 · Security Note
• https://bdu.fstec.ru/vul/2018-01131 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:0954-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16999 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0952-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0303.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16999 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16999 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16999 · Security Note
• https://osv.dev/vulnerability/MGASA-2020-0303 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16999 · Vendor Advisory