PT-2018-16243 · Nasa+1 · Cfitsio+1

Published 2018-04-16 · Updated 2025-01-17 · CVE-2018-3849

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NASA CFITSIO version 3.42

Description The issue is related to a stack-based buffer overflow in the ffghtb function. This can be triggered by specially crafted images parsed via the library, potentially allowing an attacker to overwrite arbitrary data and gain code execution. An attacker can deliver an FIT image to exploit this issue.

Recommendations For NASA CFITSIO version 3.42, consider updating to a newer version that contains a fix for this issue, as using specially crafted images can lead to a stack-based buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2021-1861

ALT-PU-2021-1918

ALT-PU-2025-1394

CVE-2018-3849

MGASA-2019-0133

OESA-2022-1533

OESA-2022-1848

Affected Products

Alt Linux

Cfitsio

References · 22

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0531 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2018-3849 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-3849 · Vendor Advisory
• https://security.gentoo.org/glsa/202101-24 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3849 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3849 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0133.html · Security Note
• https://osv.dev/vulnerability/OESA-2022-1848 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-3849 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1533 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0133 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-3849 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-3849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3848 · Security Note