CVE-2018-10717: Buffer Overflow

Published May 3, 2018

Updated

The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0.4 does not consider the bounds of the pixels data structure, which allows remote attackers to cause a denial of service (WritePixels heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted GIF file, a different vulnerability than CVE-2018-10677.

Affected Software

1 affected component

Miniupnp Project Ngiflib=0.4

Remediation

Patch Available

https://github.com/miniupnp/ngiflib/commit/cf429e0a2fe26b5f01ce0c8e9b79432e94509b6e

Event History

May 3, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-10717?

CVE-2018-10717 is classified as a denial of service vulnerability, with potential for application crashes.

How do I fix CVE-2018-10717?

To address CVE-2018-10717, users should upgrade to a patched version of ngiflib that resolves the buffer overflow issue.

What type of attack is possible with CVE-2018-10717?

CVE-2018-10717 allows remote attackers to exploit a heap-based buffer overflow, leading to denial of service.

Which software is affected by CVE-2018-10717?

CVE-2018-10717 specifically affects MiniUPnP ngiflib version 0.4.

Is CVE-2018-10717 exploitable remotely?

Yes, CVE-2018-10717 can be exploited remotely via crafted input targeting the DecodeGifImg function.