Vulnerability Details CVE-2018-3846
In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.015
EPSS Ranking 80.3%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.8
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA/
- https://security.gentoo.org/glsa/202101-24
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0529
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA/
- https://security.gentoo.org/glsa/202101-24
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0529
Products affected by CVE-2018-3846
-
cpe:2.3:a:nasa:cfitsio:3.42
-
cpe:2.3:o:fedoraproject:fedora:28