CVE-2017-8368: Buffer Overflow

Published Jul 5, 2017

Updated

Sublime Text 3 Build 3126 allows user-assisted attackers to cause a denial of service or possibly have unspecified other impact via a crafted .mkv file. One threat model is a victim who obtains an untrusted crafted file from a remote location and issues several user-defined commands, as demonstrated by Ctrl-A, Delete, and Ctrl-Z.

Affected Software

1 affected component

Sublimetext Sublime Text 3

Event History

Jul 5, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must persuade a user to obtain and open an untrusted crafted .mkv file, then have the user issue several user-defined commands. The demonstrated sequence uses Ctrl-A, Delete, and Ctrl-Z, so exploitation requires user interaction rather than occurring solely from file delivery.

Who is realistically exposed?

Users of Sublime Text 3 Build 3126 who handle .mkv files from untrusted remote sources are exposed. The impact includes denial of service and may include other unspecified effects.

How can I reduce risk if I cannot immediately address the issue?

Do not open .mkv files obtained from untrusted sources in the affected application. In particular, avoid performing the user-command sequence associated with the proof of concept on untrusted files.

CVE-2017-8368: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is realistically exposed?

How can I reduce risk if I cannot immediately address the issue?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Who is realistically exposed?

How can I reduce risk if I cannot immediately address the issue?