Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-7567 State: PUBLISHED Published: 2018-03-04T20:00:00 Last Updated: 2024-08-05T06:31:05.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server during package installation. NOTE: the vendor disputes this issue stating "the behaviour is as designed and needed for different packages to be installed", "there is a security warning if the package is not verified by OTRS Group", a
d for different packages to be installed", "there is a security warning if the package is not verified by OTRS Group", and "there is the possibility and responsibility of an admin to check packages before installation which is possible as they are not binary. Additional Analyst Notes: - CVE Program Container: References: - https://0day.today/exploit/29938
CVE ID: CVE-2018-7568 State: PUBLISHED Published: 2018-02-28T21:00:00 Last Updated: 2024-08-05T06:31:04.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22894 - https://access.redhat.com/errata/RHSA-2018:3032 - https://security.gentoo.org/glsa/201811-17 - https://access
id=22894 - https://access.redhat.com/errata/RHSA-2018:3032 - https://security.gentoo.org/glsa/201811-17 - https://access.redhat.com/errata/RHBA-2019:0327 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
CVE ID: CVE-2018-7569 State: PUBLISHED Published: 2018-02-28T21:00:00 Last Updated: 2024-08-05T06:31:04.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3032 - https://sourceware.org/bugzilla/show_bug.cgi?id=22895 - https://security.gentoo.org/glsa/201811-17 - https://access.redhat.com/errata
eware.org/bugzilla/show_bug.cgi?id=22895 - https://security.gentoo.org/glsa/201811-17 - https://access.redhat.com/errata/RHBA-2019:0327 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
CVE ID: CVE-2018-7570 State: PUBLISHED Published: 2018-02-28T21:00:00 Last Updated: 2024-08-05T06:31:04.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: The assign_file_positions_for_non_load_sections function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an ELF file with a RELRO segment that lacks a matching LOAD segment, as demonstrated by objcopy. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201811-17 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3
r: References: - https://security.gentoo.org/glsa/201811-17 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=01f7e10cf2dcf403462b2feed06c43135651556d - https://sourceware.org/bugzilla/show_bug.cgi?id=22881 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html
CVE ID: CVE-2018-7572 State: PUBLISHED Published: 2018-09-12T16:00:00 Last Updated: 2024-08-05T06:31:04.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can allow attackers to bypass Windows authentication and execute commands on the system with the privileges of Pulse Secure Client. The attacker must interrupt the client's network connectivity, and trigger a connection to a crafted proxy server with an invalid SSL certificate that allows certification-manager access, leading to the ability to browse local files and execute local programs. Additional Analyst Notes:
ation-manager access, leading to the ability to browse local files and execute local programs. Additional Analyst Notes: - CVE Program Container: References: - https://www.mdsec.co.uk/2018/09/advisory-cve-2018-7572-pulse-secure-client-authentication-bypass/
CVE ID: CVE-2018-7573 State: PUBLISHED Published: 2018-03-01T17:00:00 Last Updated: 2024-08-05T06:31:04.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in FTPShell Client 6.7. A remote FTP server can send 400 characters of 'F' in conjunction with the FTP 220 response code to crash the application; after this overflow, one can run arbitrary code on the victim machine. This is similar to CVE-2009-3364 and CVE-2017-6465. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44968/ - https://cxsecurity.com/issue/WLB-2018030011 - https://www.exploit-db.com/exploits/44596/
CVE ID: CVE-2018-7574 State: REJECTED Published: 2019-04-24T20:38:38 Last Updated: 2020-05-04T14:14:41 Description: No description available.
CVE ID: CVE-2018-7575 State: PUBLISHED Published: 2019-04-24T20:44:16 Last Updated: 2024-08-05T06:31:04.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-004.md
CVE ID: CVE-2018-7576 State: PUBLISHED Published: 2019-04-23T20:44:46 Last Updated: 2024-08-05T06:31:04.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-002.md
CVE ID: CVE-2018-7577 State: PUBLISHED Published: 2019-04-24T16:03:02 Last Updated: 2024-08-05T06:31:04.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2018-005.md
CVE ID: CVE-2018-7579 State: PUBLISHED Published: 2018-03-01T18:00:00 Last Updated: 2024-08-05T06:31:04.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: \application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/update_category_url.html. Additional Analyst Notes: - CVE Program Container: References: - http://www.atksec.com/article/yzmcms-v3.6-sqli/index.html
CVE ID: CVE-2018-7580 State: PUBLISHED Published: 2020-12-21T20:33:06 Last Updated: 2024-08-05T06:31:04.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub" will stop operating and be frozen until the flood stops. During the flood, the user won't be able to turn on/off the lights, and all of the hub's functionality will be unresponsive. The cloud service also won't work with the hub. Additional Analyst Notes: - CVE Program Container: References: - https://www.iliashn.com/CVE-2018-7580/ - http://seclists.org/fulldisclosure/
tes: - CVE Program Container: References: - https://www.iliashn.com/CVE-2018-7580/ - http://seclists.org/fulldisclosure/2020/Dec/51 - http://packetstormsecurity.com/files/160724/Philips-Hue-Denial-Of-Service.html
CVE ID: CVE-2018-7581 State: PUBLISHED Published: 2018-03-09T20:00:00 Last Updated: 2024-08-05T06:31:04.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: \ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions (BUILTIN\Users:(ID)C), which allows local users to set a cleartext password and login as admin. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/WEBLOG-EXPERT-WEB-SERVER-ENTERPRISE-v9.4-AUTHENTICATION-BYPASS.txt - http://packetstormsecurity.com/files/146697/WebLog-Expert-Web-Server-Enterprise-9.4-Weak-Permissions.html - https://www.exploit-db.com/exploits/
ty.com/files/146697/WebLog-Expert-Web-Server-Enterprise-9.4-Weak-Permissions.html - https://www.exploit-db.com/exploits/44270/
CVE ID: CVE-2018-7582 State: PUBLISHED Published: 2018-03-09T20:00:00 Last Updated: 2024-08-05T06:31:05.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to TCP port 9991. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/146698/WebLog-Expert-Web-Server-Enterprise-9.4-Denial-Of-Service.html - http://hyp3rlinx.altervista.org/advisories/WEBLOG-EXPERT-WEB-SERVER-ENTERPRISE-v9.4-DENIAL-OF-SERVICE.txt - https://www.exploit-db.com/exploits/44271/
CVE ID: CVE-2018-7583 State: PUBLISHED Published: 2018-03-04T01:00:00 Last Updated: 2024-08-05T06:31:04.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44222/
CVE ID: CVE-2018-7584 State: PUBLISHED Published: 2018-03-01T18:00:00 Last Updated: 2024-08-05T06:31:04.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3600-1/ - https://www.debian.org/security/2018/dsa-4240 - https://bugs.php.net/bug.php?id=75981 - https://lists.debian.org/debian-lts-announce/201
an.org/security/2018/dsa-4240 - https://bugs.php.net/bug.php?id=75981 - https://lists.debian.org/debian-lts-announce/2018/03/msg00030.html - https://www.tenable.com/security/tns-2018-12 - https://www.tenable.com/security/tns-2018-03 - http://www.securitytracker.com/id/1041607 - https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba - https://www.exploit-db.com/exploits/44846/ - http://php.net/ChangeLog-7.php - https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html - https://usn.ubuntu.com/3600-2/ - http://www.securityfocus.com/bid/103204 - https://access.redhat.com/errata/RHSA-2019:2519
CVE ID: CVE-2018-7586 State: PUBLISHED Published: 2018-03-01T21:00:00 Last Updated: 2024-08-05T06:31:04.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/nextgen-gallery/#developers - https://wpvulndb.com/vulnerabilities/9033
CVE ID: CVE-2018-7587 State: PUBLISHED Published: 2018-03-01T21:00:00 Last Updated: 2024-08-05T06:31:05.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure in load_bmp in CImg.h. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiaoqx/pocs/tree/master/cimg - https://usn.ubuntu.com/4039-1/
CVE ID: CVE-2018-7588 State: PUBLISHED Published: 2018-03-01T21:00:00 Last Updated: 2024-08-05T06:31:05.114Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dtschump/CImg/issues/183 - https://github.com/xiaoqx/pocs/tree/master/cimg - https://usn.ubuntu.com/4039-1/ - https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
CVE ID: CVE-2018-7589 State: PUBLISHED Published: 2018-03-01T21:00:00 Last Updated: 2024-08-05T06:31:04.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CImg v.220. A double free in load_bmp in CImg.h occurs when loading a crafted bmp image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dtschump/CImg/issues/184 - https://github.com/xiaoqx/pocs/tree/master/cimg - https://usn.ubuntu.com/4039-1/ - https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
CVE ID: CVE-2018-7590 State: PUBLISHED Published: 2018-03-01T21:00:00 Last Updated: 2024-08-05T06:31:04.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/havok89/Hoosk/issues/45
CVE ID: CVE-2018-7600 State: PUBLISHED Published: 2018-03-29T07:00:00.000Z Last Updated: 2025-10-21T23:45:52.444Z Vendors: n/a Products: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 Problem Types: remote code execution Description: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/g0rx/CVE-2018-7600-Drupal-RCE - http://www.securitytracker.com/id/1040598 - https://twitter.com/
s: - https://github.com/g0rx/CVE-2018-7600-Drupal-RCE - http://www.securitytracker.com/id/1040598 - https://twitter.com/arancaytar/status/979090719003627521 - https://twitter.com/RicterZ/status/979567469726613504 - https://www.drupal.org/sa-core-2018-002 - https://www.synology.com/support/security/Synology_SA_18_17 - https://github.com/a2u/CVE-2018-7600 - https://www.exploit-db.com/exploits/44482/ - https://research.checkpoint.com/uncovering-drupalgeddon-2/ - https://groups.drupal.org/security/faq-2018-002 - https://www.debian.org/security/2018/dsa-4156 - https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html - https://www.exploit-db.com/exploits/44448/ - http://www.securityfocus
an.org/debian-lts-announce/2018/03/msg00028.html - https://www.exploit-db.com/exploits/44448/ - http://www.securityfocus.com/bid/103534 - https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/ - https://greysec.net/showthread.php?tid=2912&pid=10561 - https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 - https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know - https://twitter.com/RicterZ/status/984495201354854401 - https://www.exploit-db.com/exploits/44449/
CVE ID: CVE-2018-7602 State: PUBLISHED Published: 2018-07-19T17:00:00.000Z Last Updated: 2025-10-21T23:45:49.564Z Vendors: Drupal Products: core Problem Types: Remote code Execution Description: A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
re being exploited in the wild. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/44557/ - http://www.securitytracker.com/id/1040754 - https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html - https://www.exploit-db.com/exploits/44542/ - https://www.debian.org/security/2018/dsa-4180 - https://www.drupal.org/sa-core-2018-004 - http://www.securityfocus.com/bid/103985
CVE ID: CVE-2018-7603 State: PUBLISHED Published: 2019-01-15T22:00:00Z Last Updated: 2024-09-17T02:57:47.547Z Vendors: Drupal Products: 3rd party module - Search Autocomplete Problem Types: A vulnerability in search auto complete a 3rd party Druapl contributed module. Search Autocomplete allows an attacker to execute javascript code to causing xss. Affected releases are Drupal 3rd party module - Search Autocomplete: versions prior to 7.x-4.8. Description: In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments,
y. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/sa-contrib-2018-070
CVE ID: CVE-2018-7631 State: PUBLISHED Published: 2018-10-09T22:00:00 Last Updated: 2024-08-05T06:31:04.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to execute code remotely via a specially crafted GET request without a leading "/" and without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://fschallock.wordpress.com/2018/10/07/cve-2018-7631-rce-in-adb-epicentro-7-3-2-httpd/
CVE ID: CVE-2018-7632 State: PUBLISHED Published: 2018-10-09T22:00:00 Last Updated: 2024-08-05T06:31:05.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to cause a denial of service attack remotely via a specially crafted GET request with a leading "/" in the URL. Additional Analyst Notes: - CVE Program Container: References: - https://fschallock.wordpress.com/2018/10/08/cve-2018-7632-buffer-overflow-in-httpd-in-epicentro-e_7-3-2-allows-attackers-to-cause-a-denial-of-service-attack-remotely-via-a-specially-crafted-get-request/
CVE ID: CVE-2018-7633 State: PUBLISHED Published: 2018-10-09T22:00:00 Last Updated: 2024-08-05T06:31:04.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Code injection in the /ui/login form Language parameter in Epicentro E_7.3.2+ allows attackers to execute JavaScript code by making a user issue a manipulated POST request. Additional Analyst Notes: - CVE Program Container: References: - https://fschallock.wordpress.com/2018/10/08/cve-2018-7633-script-injection-in-the-login-form-language-parameter-of-adb-firmware-epicentro-7-3-2/
CVE ID: CVE-2018-7634 State: PUBLISHED Published: 2018-03-01T22:00:00 Last Updated: 2024-08-05T06:31:05.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by attackers. By making a CSRF attack, an attacker could make a victim change his registered e-mail address on the application, leading to account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://mustafairan.wordpress.com/2018/03/05/tuleap-mail-change-csrf-vulnerability-leads-to-account-takeover/ - https://tuleap.net/plugins/tracker/?aid=1
/2018/03/05/tuleap-mail-change-csrf-vulnerability-leads-to-account-takeover/ - https://tuleap.net/plugins/tracker/?aid=11217 - https://twitter.com/Mustafaran/status/970745812887199744 - https://github.com/Enalean/tuleap/commit/0843c046eee54b16ec6a7753c575838212770189 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=commit&h=d6701289ae55de900929ff0f66313fa9771a198d
CVE ID: CVE-2018-7635 State: PUBLISHED Published: 2018-07-03T15:00:00 Last Updated: 2024-08-05T06:31:05.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name. Additional Analyst Notes: - CVE Program Container: References: - https://cve.naver.com/detail/cve-2018-7635.html
CVE ID: CVE-2018-7636 State: PUBLISHED Published: 2018-07-03T21:00:00 Last Updated: 2024-08-05T06:31:05.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041207 - http://www.securityfocus.com/bid/104673 - https://security.paloaltonetworks.com/CVE-2018-7636
CVE ID: CVE-2018-7637 State: PUBLISHED Published: 2018-03-02T14:00:00 Last Updated: 2024-08-05T06:31:04.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "16 colors" case, aka case 4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dtschump/CImg/issues/185 - https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
CVE ID: CVE-2018-7638 State: PUBLISHED Published: 2018-03-02T14:00:00 Last Updated: 2024-08-05T06:31:05.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "256 colors" case, aka case 8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dtschump/CImg/issues/185 - https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html
CVE ID: CVE-2018-7639 State: PUBLISHED Published: 2018-03-02T14:00:00 Last Updated: 2024-08-05T06:31:04.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a different vulnerability than CVE-2018-7588. This is in a "16 bits colors" case, aka case 16. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dtschump/CImg/issues/185 - https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html