CVE-2018-14337: Integer Overflow

Published Jul 17, 2018

Updated

The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrbstrresize function in string.c does not check for a negative length.

Affected Software

2 affected components

mruby mruby=1.4.1

Debian Debian Linux=9.0

Event History

Jul 17, 2018

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is CVE-2018-14337?

CVE-2018-14337 is a vulnerability in mruby 1.4.1 that contains a signed integer overflow, possibly leading to out-of-bounds memory access.

Is mruby version 1.4.1 affected by CVE-2018-14337?

Yes, mruby version 1.4.1 is affected by CVE-2018-14337.

What is the severity of CVE-2018-14337?

The severity of CVE-2018-14337 is high with a CVSS score of 7.5.

How can I fix the vulnerability CVE-2018-14337?

To fix the vulnerability CVE-2018-14337, update to a version of mruby that is not affected.

Where can I find more information about CVE-2018-14337?

You can find more information about CVE-2018-14337 at the following references: [Link 1](https://github.com/mruby/mruby/issues/4062), [Link 2](https://lists.debian.org/debian-lts-announce/2022/05/msg00006.html).