What is CVE-2018-1000221?

CVE-2018-1000221 is a critical-severity vulnerability in Pkgconf, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2018-08-20.

How severe is CVE-2018-1000221?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Buffer overflow in Pkgconf

CVE-2018-1000221

pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.

Vulnerability class: Buffer Overflow

EPSS: 0.014 (68.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Pkgconf
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2018-1000221?: CVE-2018-1000221 is a critical-severity vulnerability in Pkgconf, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.8/10. Published 2018-08-20.
How severe is CVE-2018-1000221?: Critical severity. CVSS v3 base score is 9.8 out of 10.