PT-2018-2597 · Libcaca+2 · Libcaca+2

Fgeeko · Published 2018-11-22 · Updated 2025-01-13 · CVE-2018-20545

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libcaca version 0.99.beta19

Description The issue is related to an integer overflow in the load image function, located in common-image.c, which can lead to an illegal WRITE memory access, particularly for 4bpp data. This can potentially allow a remote attacker to execute arbitrary code.

Recommendations For libcaca version 0.99.beta19, consider disabling the load image function until a patch is available to prevent potential exploitation. Restrict access to the common-image.c module to minimize the risk of exploitation. Avoid using the load image function for 4bpp data until the issue is resolved.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2019-01073

CVE-2018-20545

MGASA-2019-0050

OPENSUSE-SU-2019:1144-1

OPENSUSE-SU-2019_1144-1

OPENSUSE-SU-2024:10927-1

ROSA-SA-2025-2554

SUSE-SU-2019:0770-1

SUSE-SU-2019:2745-1

SUSE-SU-2019:2745-2

USN-3860-1

USN-3860-2

Affected Products

Suse

Ubuntu

Libcaca

References · 57

• 🔥 https://github.com/cacalabs/libcaca/issues/37 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1652621 · Exploit
• https://github.com/cacalabs/libcaca/commit/3e52dabe3e64dc50f4422effe364a1457a8a8592 · Patch
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://usn.ubuntu.com/3860-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-20545 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:2745-2 · Vendor Advisory
• https://usn.ubuntu.com/3860-2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01073 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:0770-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20545 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20544 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3860-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20546 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20547 · Vendor Advisory