CVE-2018-3846: Buffer Overflow
In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2018-3846.
What is the severity of CVE-2018-3846?
The severity of CVE-2018-3846 is high with a CVSS score of 8.8.
Which software versions are affected by CVE-2018-3846?
NASA CFITSIO version 3.42 and Fedoraproject Fedora version 28 are affected by CVE-2018-3846.
What can an attacker potentially achieve through CVE-2018-3846?
An attacker can potentially gain code execution through CVE-2018-3846.
Are there any references related to CVE-2018-3846?
Yes, you can find more information about CVE-2018-3846 in the following references: 1. [Fedoraproject Fedora Security Announcement](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K46I2MFPCEOGC5LLDXZSWPB3EBPON3KA/) 2. [Gentoo Linux Security Advisory](https://security.gentoo.org/glsa/202101-24) 3. [Cisco Talos Vulnerability Report](https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0529)