CVE-2018-3848: Buffer Overflow
In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-3848?
CVE-2018-3848 is a vulnerability in NASA CFITSIO 3.42 that allows specially crafted images to cause a stack-based buffer overflow, potentially leading to code execution.
How does the ffghbn function in NASA CFITSIO 3.42 trigger CVE-2018-3848?
The ffghbn function in NASA CFITSIO 3.42 can trigger CVE-2018-3848 by parsing specially crafted images, which can cause a stack-based buffer overflow and overwrite arbitrary data.
What is the severity of CVE-2018-3848?
CVE-2018-3848 has a severity rating of 8.8 (high).
Which software versions are affected by CVE-2018-3848?
Versions up to and excluding 3.490 of NASA CFITSIO and Fedora 28 are affected by CVE-2018-3848.
How can an attacker exploit CVE-2018-3848?
An attacker can exploit CVE-2018-3848 by delivering a specially crafted FIT image, which triggers the vulnerability and potentially allows for code execution.