CVE-2018-8975 Memory corruption in n/a

Medium 5.5 Published 25 Mar 2018 Updated 5 Aug 2024

Remote attackers can cause a denial of service via heap-based buffer over-read in Netpbm by providing a crafted image file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-8975?

CVE-2018-8975 is a medium-severity memory corruption vulnerability in n/a, published on 25 Mar 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The pm_mallocarray2 function in lib/util/mallocvar.c in Netpbm through 10.81.03 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, as demonstrated by pbmmask.

Weakness: CWE-125

Which versions are affected by CVE-2018-8975?

It affects 1 product.

Linux distribution packages (4)

`netpbm` SUSE:Linux Enterprise Module for Basesystem 15	All versions	`10.80.1-3.3.36`
`netpbm` SUSE:Linux Enterprise Module for Desktop Applications 15	All versions	`10.80.1-3.3.36`
`netpbm` openSUSE:Leap 15.0	All versions	`10.80.1-lp150.2.3.1`
`netpbm` openSUSE:Tumbleweed	All versions	`10.93.0-1.6`

Products include Netpbm Project Netpbm.

How do I fix CVE-2018-8975?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-8975 being exploited?

There is no known exploitation of CVE-2018-8975 in the wild and no public exploit code.

Sources

Also known as GHSA-vq9h-w3r5-w484, MGASA-2019-0183, SUSE-SU-2019:0855-1, openSUSE-SU-2019:1200-1, openSUSE-SU-2024:11084-1.