CVE-2018-12098 - The liblnk_data_block_read function in liblnk_data_block.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file

Back Back to CVE browser

MEDIUM

The liblnk_data_block_read function in liblnk_data_block.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file

Published Jun 19, 2018

5.5

MEDIUM

CVSS 3.0

EPSS 0.60%

Description

The liblnk_data_block_read function in liblnk_data_block.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-200

Exposure of Sensitive Information

References (2)

http://seclists.org/fulldisclosure/2018/Jun/33
mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-4078
Advisory

Link	Providers	Tags
http://seclists.org/fulldisclosure/2018/Jun/33		mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-4078		Advisory