PT-2018-3473 · Liblouis+2 · Liblouis+2

Henri Salo · Published 2018-06-02 · Updated 2024-06-15 · CVE-2018-11683

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Liblouis version 3.5.0

Description: The issue is related to a stack-based buffer overflow in the parseChars function in compileTranslationTable.c. This allows a remote attacker to potentially execute arbitrary code. The vulnerability is distinct from previous issues.

Recommendations: For Liblouis version 3.5.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the parseChars function until a patch is available. Restrict access to the compileTranslationTable.c module to minimize the risk of exploitation. Avoid using the parseChars function in sensitive operations until the issue is resolved.

Exploit

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2020-01880

CVE-2018-11683

OPENSUSE-SU-2018_2819-1

OPENSUSE-SU-2019:1160-1

OPENSUSE-SU-2019_1160-1

OPENSUSE-SU-2024:10953-1

SUSE-SU-2018:2569-1

SUSE-SU-2018:2780-1

SUSE-SU-2018_2569-1

SUSE-SU-2019:0795-1

USN-3672-1

Affected Products

Liblouis

Suse

Ubuntu

References · 46

• 🔥 https://github.com/Edward-L/fuzzing-pocs/tree/master/liblouis · Exploit
• https://ubuntu.com/security/CVE-2018-11684 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10953-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2780-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-11683 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2569-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html · Vendor Advisory
• https://usn.ubuntu.com/3672-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3672-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11683 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0795-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-11683 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3672-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-11683 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-11685 · Vendor Advisory