CVE-2018-19353: Medium severity ansilove vulnerability
The ansiloveansi function in loaders/ansi.c in libansilove 1.0.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the crash?
The attacker must provide a crafted file that is processed by the ansilove_ansi function in loaders/ansi.c. Exploitation requires user interaction, as reflected by the CVSS UI:R vector.
What is the practical impact of successful exploitation?
Successful exploitation causes an out-of-bounds read that can crash the application, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.
Which deployments are most exposed?
Deployments that process ANSI files from remote or untrusted sources are exposed, because the crafted input must reach libansilove's ANSI loader. The data identifies libansilove 1.0.0 as affected.