CVE-2018-20340 Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using....
MediumCVSS 6.8
EPSS 0.50%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libu2f-host(Debian:12) | < 1.1.7-1 | 1.1.7-1 |
| debian/libu2f-host(Debian:13) | < 1.1.7-1 | 1.1.7-1 |
| debian/libu2f-host(Debian:14) | < 1.1.7-1 | 1.1.7-1 |
| Yubico libu2f-host | = 1.1.6 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-20340 vendor-advisory
- blog.inhq.net
- developers.yubico.com release-notes vendor-advisory
- seclists.org mailing-list third-party-advisory
- GLSA-202004-15 vendor-advisory
- www.debian.org third-party-advisory
- www.yubico.com patch vendor-advisory
- bugs.debian.org issue-tracking