CVE-2018-8754

2018-03-1800:00:00

ubuntu.com

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.6%

JSON

DISPUTED The libevt_record_values_read_event() function in
libevt_record_values.c in libevt before 2018-03-17 does not properly check
for out-of-bounds values of user SID data size, strings size, or data size.
NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on
GitHub.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893431>

OSVersionArchitecturePackageVersionFilename
ubuntu17.10noarchlibevt< 20170120-1+deb9u1build0.17.10.1UNKNOWN
ubuntu18.04noarchlibevt< 20170120-2UNKNOWN
ubuntu18.10noarchlibevt< 20170120-2UNKNOWN
ubuntu19.04noarchlibevt< 20170120-2UNKNOWN
ubuntu19.10noarchlibevt< 20170120-2UNKNOWN
ubuntu20.04noarchlibevt< 20170120-2UNKNOWN
ubuntu20.10noarchlibevt< 20170120-2UNKNOWN
ubuntu21.04noarchlibevt< 20170120-2UNKNOWN
ubuntu21.10noarchlibevt< 20170120-2UNKNOWN
ubuntu22.04noarchlibevt< 20170120-2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	17.10	noarch	libevt	< 20170120-1+deb9u1build0.17.10.1	UNKNOWN
ubuntu	18.04	noarch	libevt	< 20170120-2	UNKNOWN
ubuntu	18.10	noarch	libevt	< 20170120-2	UNKNOWN
ubuntu	19.04	noarch	libevt	< 20170120-2	UNKNOWN
ubuntu	19.10	noarch	libevt	< 20170120-2	UNKNOWN
ubuntu	20.04	noarch	libevt	< 20170120-2	UNKNOWN
ubuntu	20.10	noarch	libevt	< 20170120-2	UNKNOWN
ubuntu	21.04	noarch	libevt	< 20170120-2	UNKNOWN
ubuntu	21.10	noarch	libevt	< 20170120-2	UNKNOWN
ubuntu	22.04	noarch	libevt	< 20170120-2	UNKNOWN