CVE-2018-10733: Buffer Overflow
A flaw was found in libgxps through 0.3.0. There is a heap-based buffer over-read in the function ftfontfacehash of gxps-fonts.c. A crafted input will lead to a remote denial of service attack.
References: https://bugzilla.redhat.com/showbug.cgi?id=1574844
Patches: https://git.gnome.org/browse/libgxps/commit/?id=b458226e162fe1ffe7acb4230c114a52ada5131b https://git.gnome.org/browse/libgxps/commit/?id=133fe2a96e020d4ca65c6f64fb28a404050ebbfd
Other sources
There is a heap-based buffer over-read in the function ftfontfacehash of gxps-fonts.c in libgxps through 0.3.0. A crafted input will lead to a remote denial of service attack.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10733?
CVE-2018-10733 is classified as a high severity vulnerability due to its potential to cause remote denial of service.
How do I fix CVE-2018-10733?
To fix CVE-2018-10733, upgrade to a version of libgxps later than 0.3.0 that addresses the heap-based buffer over-read.
Which software is affected by CVE-2018-10733?
CVE-2018-10733 affects libgxps up to version 0.3.0, and also impacts specific versions of Red Hat Ansible Tower and Red Hat Enterprise Linux.
What type of vulnerability is CVE-2018-10733?
CVE-2018-10733 is a heap-based buffer over-read vulnerability.
Can CVE-2018-10733 lead to data leakage?
While primarily causing denial of service, CVE-2018-10733 could potentially lead to data leakage under specific conditions due to the buffer over-read.