PT-2018-16242 · Nasa+1 · Cfitsio+1

Published 2018-04-16 · Updated 2025-01-17 · CVE-2018-3848

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NASA CFITSIO version 3.42

Description The issue is related to a stack-based buffer overflow in the ffghbn function when parsing specially crafted images via the library. This can lead to overwriting arbitrary data, potentially allowing an attacker to gain code execution by delivering a crafted FIT image.

Recommendations For NASA CFITSIO version 3.42, consider disabling the ffghbn function until a patch is available to prevent potential exploitation. Restrict access to parsing untrusted FIT images to minimize the risk of triggering this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2021-1861

ALT-PU-2021-1918

ALT-PU-2025-1394

CVE-2018-3848

MGASA-2019-0133

OESA-2022-1533

OESA-2022-1848

Affected Products

Alt Linux

Cfitsio

References · 21

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0531 · Exploit
• https://security.gentoo.org/glsa/202101-24 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-3848 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0133.html · Security Note
• https://osv.dev/vulnerability/OESA-2022-1848 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-3848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3849 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3848 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1533 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-3848 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0133 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3848 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3848 · Vendor Advisory