CVE-2018-25033 Out-of-bounds read in admesh

High 8.1 Published 8 May 2022 Updated 5 Aug 2024

A heap-based buffer over-read in ADMesh allows attackers to cause denial of service or disclose sensitive memory contents via crafted STL files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-25033?

CVE-2018-25033 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 8 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.

Weakness: CWE-125

Which versions are affected by CVE-2018-25033?

3 open source packages ship an affected version, including admesh. It affects 2 products.

Package	Affected	Fixed in
`admesh` PyPI	All versions	`0.98.5`
`admesh` PyPI	All versions	`0.98.5`
`admesh` PyPI	All versions	`0.98.5`

Products include Admesh Project Admesh, Debian Debian Linux.

How do I fix CVE-2018-25033?

Upgrade admesh to 0.98.5 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-25033 being exploited?

There is no known exploitation of CVE-2018-25033 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-25033, DLA-3019-1, GHSA-5jrq-582v-9767, MGASA-2022-0209, PYSEC-2022-182, UBUNTU-CVE-2018-25033.