Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2018-17043: doc2txt can crash or be exploited via crafted document
CVE-2018-17043 · published 8 years ago
Summary
The doc2txt tool may mishandle specially crafted files, causing it to write over its own memory and potentially stop working or allow unwanted actions. This happens when the program processes certain documents. Upgrade to a patched version or stop opening untrusted documents with doc2txt until a fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| doc2txt_project | doc2txt |
<= 2014-03-19 cpe:2.3:a:doc2txt_project:doc2txt:*:*:*:*:*:*:*:* |
Original advisory text
An issue has been found in doc2txt through 2014-03-19. It is a heap-based buffer overflow in the function Storage::init in Storage.cpp, called from parse_doc in parse_doc.cpp.
An issue has been found in doc2txt through 2014-03-19. It is a heap-based buffer overflow in the function Storage::init in Storage.cpp, called from parse_doc in parse_doc.cpp.
References
- https://github.com/grandnew/software-vulnerabilities/tree/master/doc2txt#heap-bu... Exploit Third Party Advisory
- https://github.com/tsfn/doc2txt/issues/1 Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-787Out-of-bounds Write
Timeline
Published14 Sep 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-17043 · NVD
Track software like this
Free during beta