Improper input validation in Boost

CVE-2013-0252

boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.029 (85.4th percentile) — read the EPSS interpretation.

Affected products

  • Boost — versions 1.48.0, 1.49.0, 1.50.0
  • N/a — versions n/a

Weakness classification (CWE)

References