Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

libfsclfs may let attackers read extra memory

CVE-2018-15157 · published 8 years ago
Summary

The libfsclfs library, used for handling Windows transaction log files, can be tricked by a specially crafted file to read data beyond what it should. This could cause the program to crash or expose sensitive information. Update libfsclfs to the version released after July 25, 2018, or apply any patches provided by the project.

What to do
  • Update libfsclfs_project libfsclfs to version 2018-07-25 or later.
Affected software
VendorProductAffected versions
libfsclfs_project libfsclfs < 2018-07-25
cpe:2.3:a:libfsclfs_project:libfsclfs:*:*:*:*:*:*:*:*
Original advisory text
The libfsclfs_block_read function in libfsclfs_block.c in libfsclfs before 2018-07-25 allows remote attackers to cause a heap-based buffer over-read via a crafted clfs file. NOTE: the vendor has di...
The libfsclfs_block_read function in libfsclfs_block.c in libfsclfs before 2018-07-25 allows remote attackers to cause a heap-based buffer over-read via a crafted clfs file. NOTE: the vendor has disputed this as described in the GitHub issue comments
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published1 Sep 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-15157 · NVD
Track software like this
Free during beta