This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-17942 →

DEBIAN-CVE-2018-17942

The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a tra...

Original description

The description as published by the source.

The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 gnulib

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140202+stable-3.1"}]}]

Debian:13 gnulib

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140202+stable-3.1"}]}]

Debian:14 gnulib

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140202+stable-3.1"}]}]

References

advisory security-tracker.debian.org