CVE-2018-19497
MEDIUM EPSS 71.5%
Published Nov 29, 20187y ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Published Nov 29, 2018 7y ago
Last Modified Jun 17, 2026 2w ago
Description
In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service (SEGV on unknown address with READ memory access in a tsk_getu16 call in hfs_dir_open_meta_cb in tsk/fs/hfs_dent.c).
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
71.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-125 Out-of-bounds Read Memory Safety
Affected Products 5
| Vendor | Product | Version | Range |
|---|---|---|---|
| sleuthkit | the_sleuth_kit | * | ≤4.6.4 |
| debian | debian_linux | 8.0 | any |
| debian | debian_linux | 9.0 | any |
| fedoraproject | fedora | 29 | any |
| fedoraproject | fedora | 30 | any |
References 6
- github.com https://github.com/sleuthkit/sleuthkit/commit/bc04aa017c0bd297de8a3b7fc40ffc6ddddbb95d
- github.com https://github.com/sleuthkit/sleuthkit/pull/1374
- lists.debian.org https://lists.debian.org/debian-lts-announce/2018/12/msg00008.html
- lists.debian.org https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZXFYOOMSP7NWRTSO4XXGHXAY3CJNAJ6/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLSVLDQLPGKRHHBPYUXVJJPAID6CYBXD/
Remediation
- github.com https://github.com/sleuthkit/sleuthkit/commit/bc04aa017c0bd297de8a3b7fc40ffc6ddddbb95d
- github.com https://github.com/sleuthkit/sleuthkit/pull/1374