Improper input validation in Alps Pointing-Device Driver
CVE-2018-10828
An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and write to the "ApMsgFwd File Mapping Object" section. ApMsgFwd.exe uses the data written to this section as arguments to functions. This causes a denial of service condition when invalid pointers are written to the mapped section. This driver has been used with Dell, ThinkPad, and VAIO devices.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.014 (69.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Alps Pointing-device_driver — versions 10.1.101.207
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2018-10828?
- CVE-2018-10828 is a medium-severity vulnerability in Alps Pointing-Device Driver, classified under Improper Input Validation. CVSS score: 5.5/10. Published 2018-05-09.
- How severe is CVE-2018-10828?
- Medium severity. CVSS v3 base score is 5.5 out of 10.