CVE-2018-1000221

2022-10-0316:21:59

mitre

www.cve.org

pkgconf

buffer overflow

dequote() function

vulnerability

1.5.0 to 1.5.2

1.5.3 fix

.pc file

cve-2018-1000221

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.0%

JSON

pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.