CVE-2018-1000052 Memory corruption in n/a
An attacker can cause a denial of service via memory corruption in fmtlib by specifying an invalid format specifier in the print function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000052?
CVE-2018-1000052 is a high-severity memory corruption vulnerability in n/a, published on 9 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-134 vulnerability in fmt::print() library function that can result in Denial of Service. This attack appear to be exploitable via Specifying an invalid format specifier in the fmt::print() function results in a SIGSEGV (memory corruption, invalid write). This vulnerability appears to have been fixed in after commit 8cf30aa2be256eba07bb1cefb998c52326e846e7.
Weakness: CWE-134
Which versions are affected by CVE-2018-1000052?
It affects 1 product.
Products include Fmt Fmt.
How do I fix CVE-2018-1000052?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-1000052 being exploited?
There is no known exploitation of CVE-2018-1000052 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-1000052, GHSA-w83v-wch9-fjvr, UBUNTU-CVE-2018-1000052.