CVE-2018-18398 Memory corruption in n/a
A local attacker can cause a denial of service in Thunar by exploiting an out-of-bounds read in the IBus-Unikey input method during file searches.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18398?
CVE-2018-18398 is a medium-severity memory corruption vulnerability in n/a, published on 19 Oct 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bounds read and SEGV. This could potentially be exploited by an arbitrary local user who creates files in /tmp before the victim uses this input method.
Weakness: CWE-125
Which versions are affected by CVE-2018-18398?
It affects 2 products.
Products include Xfce Thunar, Xfce Xfce.
How do I fix CVE-2018-18398?
No fix has been published for CVE-2018-18398 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-18398 being exploited?
There is no known exploitation of CVE-2018-18398 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2018-18398, GHSA-8953-rxhp-x9jm, UBUNTU-CVE-2018-18398.