CVE-2018-3849

In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution...

CVE-2018-3849

CFITSIO 3.42 contains a stack-based buffer overflow in ffghtb() that can be triggered by a crafted FIT image, potentially allowing remote code execution. The connected notes indicate this CVE (CVE-2018-3849) is discussed in unpatched advisories for some Linux distributions (e.g., Red Hat/UNPATCHE...

CVE-2018-3846

NASA CFITSIO 3.42 is affected by CVE-2018-3846, where the ffgphd and ffgtkn functions can be triggered by specially crafted FIT images, causing a stack-based buffer overflow and potentially allowing arbitrary code execution. The vulnerability is described in Nessus/NVD entries as exploitable via ...

CVE-2018-3848

CVE-2018-3848 affects NASA CFITSIO before 3.43 (CFITSIO 3.42 in the report). The vulnerability is a stack-based buffer overflow in the ffghbn function that can be triggered by specially crafted FITS images parsed by the library, potentially leading to arbitrary code execution. The initial documen...

CVE-2018-3846

In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution...

CVE-2018-3849

In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution...

CVE-2018-3846

In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution...

CVE-2018-3848: Out-of-bounds Write

In the ffghbn function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution...

CVE-2018-3849: Out-of-bounds Write

In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution...

CVE-2018-3846: Out-of-bounds Write

In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution...

PT-2018-16242 · Nasa +1 · Cfitsio +1

Name of the Vulnerable Software and Affected Versions: NASA CFITSIO version 3.42 Description: The issue is related to a stack-based buffer overflow in the ffghbn function when parsing specially crafted images via the library. This can lead to overwriting arbitrary data, potentially allowing an...

Vulnerability Spotlight: TALOS-2018-0529-531 - Multiple Vulnerabilities in NASA CFITSIO library

Vulnerabilities discovered by Tyler Bohan from Talos Overview Talos is disclosing three remote code execution vulnerabilities in the NASA CFITSIO library. CFITSIO is a library of C and Fortran subroutines for reading and writing data files in the Flexible Image Transport System FITS data format...

oig.nasa.gov XSS vulnerability

Open Bug Bounty ID: OBB-600693 Description| Value ---|--- Affected Website:| oig.nasa.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

NASA CFITSIO `ffgkyn` Stack Overflow Code Execution Vulnerability

Summary Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigg...

NASA CFITSIO Multiple Stack Overflow Code Execution Vulnerabilities

Summary Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigg...

worldwind.arc.nasa.gov Improper Access Control vulnerability

Open Bug Bounty ID: OBB-593641 Description| Value ---|--- Affected Website:| worldwind.arc.nasa.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

science.gsfc.nasa.gov XSS vulnerability

Open Bug Bounty ID: OBB-556120 Description| Value ---|--- Affected Website:| science.gsfc.nasa.gov Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosu...

CVE-2018-1000045

NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library Weather data that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.1...

CVE-2018-1000048

NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code execution. This attack appear to be exploitable via Victim tries to retrieve and process a weather data file...

CVE-2018-1000047

NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execution. This attack appear to be exploitable via Victim opens an untrusted file for optimization using Kodiak library...