Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-11723: libpff can expose data when opening crafted files

CVE-2018-11723 · published 8 years ago

Summary

The libpff library may read beyond its intended memory area if it processes a specially crafted PFF file, potentially leaking information from the system's memory. This can happen when an attacker sends a malicious file to a service that uses libpff. Apply any available updates from the libpff project or avoid processing untrusted PFF files until a fix is released.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
libpff_project	libpff	<= 20180428 `cpe:2.3:a:libpff_project:libpff::::::::`

Original advisory text

The libpff_name_to_id_map_entry_read function in libpff_name_to_id_map.c in libyal libpff through 2018-04-28 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted pff file. NOTE: the vendor has disputed this as described in libyal/libpff issue 66 on GitHub

References

http://packetstormsecurity.com/files/148113/libpff-2018-04-28-Information-Disclo... Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2018/Jun/15 Mailing List Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published19 Jun 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-11723 · NVD

Track software like this

Free during beta