CVE-2018-3849 In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to...
HighCVSS 8.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cfitsio(Debian:12) | < 3.430-1 | 3.430-1 |
| debian/cfitsio(Debian:13) | < 3.430-1 | 3.430-1 |
| debian/cfitsio(Debian:14) | < 3.430-1 | 3.430-1 |
| nasa cfitsio | < 3.490 | 3.490 |
| fedoraproject fedora | = 28 | No fix listed |
| Talos NASA CFITSIO | = NASA CFITSIO 3.42 | No fix listed |
References
- Debian Security Tracker CVE-2018-3849 vendor-advisory
- FEDORA-2019-3c1aed2aa9 vendor-advisory
- GLSA-202101-24 third-party-advisory vendor-advisory
- www.talosintelligence.com exploit technical-description third-party-advisory
- bugs.debian.org issue-tracking