PT-2018-8859 · Rtsoft · Dink Smallwood Hd+2

Beuc + 2 · Published 2018-06-12 · Updated 2019-03-01 · CVE-2018-0496

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions DFArc versions prior to 3.14 DFArc2 versions prior to 3.14 Dink Smallwood HD versions prior to 3.14

Description The issue is related to directory traversal in the D-Mod extractor, which can be exploited by an attacker to overwrite arbitrary files on the user's system.

Recommendations For DFArc versions prior to 3.14, update to version 3.14 or later. For DFArc2 versions prior to 3.14, update to version 3.14 or later. For Dink Smallwood HD versions prior to 3.14, update to version 3.14 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-0496

DLA-1686-1

MGASA-2018-0287

Affected Products

Dfarc

Dfarc2

Dink Smallwood Hd

References · 14

• https://savannah.gnu.org/forum/forum.php?forum_id=9169 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-0496 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-0496 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-0496 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0287.html · Security Note
• https://ubuntu.com/security/CVE-2018-0496 · Vendor Advisory
• https://git.savannah.gnu.org/cgit/freedink/dfarc.git/commit/?id=40cc957f52e772f45125126439ba9333cf2d2998 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0287 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-0496 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0496 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1686-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0496 · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=23188 · Note
• https://lists.debian.org/debian-lts-announce/2019/02/msg00033.html · Note