PT-2018-2598 · Libcaca+2 · Libcaca+2

Fgeeko · Published 2018-11-22 · Updated 2025-01-13 · CVE-2018-20546

Positive Technologies (AI Summary)

CVSS v2.0

8.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions libcaca version 0.99.beta19

Description The issue is related to an integer overflow in the get rgba default function of the libcaca graphic library, located in caca/dither.c. This can lead to an illegal READ memory access, potentially allowing a remote attacker to gain unauthorized access to protected information.

Recommendations For libcaca version 0.99.beta19, consider restricting access to the get rgba default function in caca/dither.c as a temporary workaround until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2019-01074

CVE-2018-20546

DLA-1631-1

MGASA-2019-0050

OPENSUSE-SU-2019:1144-1

OPENSUSE-SU-2019_1144-1

OPENSUSE-SU-2024:10927-1

ROSA-SA-2025-2554

SUSE-SU-2019:0770-1

SUSE-SU-2019:2745-1

SUSE-SU-2019:2745-2

USN-3860-1

USN-3860-2

Affected Products

Suse

Ubuntu

Libcaca

References · 58

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1652622 · Exploit
• https://github.com/cacalabs/libcaca/commit/1022d97496c7899e8641515af363381b31ae2f05 · Patch
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-20546 · Vendor Advisory
• https://usn.ubuntu.com/3860-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2745-2 · Vendor Advisory
• https://usn.ubuntu.com/3860-2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-20546 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:0770-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20545 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20544 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3860-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20546 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20546 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20547 · Vendor Advisory