CVE-2018-17825 Use after free in n/a
A double-free vulnerability in the AdPlug library allows attackers to cause denial of service or potentially execute arbitrary code via crafted audio files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-17825?
CVE-2018-17825 is a critical use after free vulnerability in Fedoraproject Fedora, published on 1 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in AdPlug 2.3.1. There are several double-free vulnerabilities in the CEmuopl class in emuopl.cpp because of a destructor's two OPLDestroy calls, each of which frees TL_TABLE, SIN_TABLE, AMS_TABLE, and VIB_TABLE.
Weakness: CWE-415
Which versions are affected by CVE-2018-17825?
It affects 2 products.
Products include Adplug Project Adplug, Fedoraproject Fedora.
How do I fix CVE-2018-17825?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-17825 being exploited?
There is no known exploitation of CVE-2018-17825 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2018-17825, DLA-1534-1, GHSA-99v5-m7fh-mfq3, UBUNTU-CVE-2018-17825.