Catalogo CVE

CVE-2018-17942

gnulib: CVE-2018-17942

Gravità: Medium
Published: Oct 3, 2018, 8:29:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.49% · Oct 22, 2026

The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\0' character during %f processing.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gnulib	sid	`20260704-3`	fixed
Debian	gnulib	forky	`20260704-3`	fixed
Debian	gnulib	trixie	`20250303-1`	fixed
Debian	gnulib	bookworm	`20230209+stable-1`	fixed
Ubuntu	gnulib	16.04	`20140202+stable-2`	vulnerable
Ubuntu	gnulib	16.04	`20140202+stable-2+deb8u1build0.16.04.1`	fixed
Ubuntu	gnulib	18.04	`20140202+stable-2`	vulnerable
Ubuntu	gnulib	18.04	`20140202+stable-2build1`	vulnerable
Ubuntu	gnulib	18.04	`20140202+stable-2+deb8u1build0.18.04.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gnulib	source	sid	`20140202+stable-3.1`	low	Not reported	[910757]
Debian	gnulib	source	forky	`20140202+stable-3.1`	low	Not reported	[910757]
Debian	gnulib	source	trixie	`20140202+stable-3.1`	low	Not reported	[910757]
Debian	gnulib	source	bookworm	`20140202+stable-3.1`	low	Not reported	[910757]
Ubuntu	gnulib	deb	16.04	`20140202+stable-2+deb8u1build0.16.04.1`	Not reported	UBUNTU-CVE-2018-17942	Not reported
Ubuntu	gnulib	deb	18.04	`20140202+stable-2+deb8u1build0.18.04.1`	Not reported	UBUNTU-CVE-2018-17942	Not reported

[Debian bug #910757]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[git-merge-changelog]Corretta
Pacchetto sorgente: [gnulib]
Dettagli (2)
- 20230209+stable-1 · amd64 · bookworm
  Corretta · Corretta: 20140202+stable-3.1
  dsa · gnulib · debian · bookworm; dsa · gnulib · debian · 12
- 20230209+stable-1 · arm64 · bookworm
  Corretta · Corretta: 20140202+stable-3.1
  dsa · gnulib · debian · bookworm; dsa · gnulib · debian · 12
[gnulib]Corretta
Dettagli (2)
- 20230209+stable-1 · all · bookworm
  Corretta · Corretta: 20140202+stable-3.1
  dsa · gnulib · debian · bookworm; dsa · gnulib · debian · 12
- 20230209+stable-1 · all · bookworm
  Corretta · Corretta: 20140202+stable-3.1
  dsa · gnulib · debian · bookworm; dsa · gnulib · debian · 12

[Debian 13 (Trixie)]

[git-merge-changelog]Corretta
Pacchetto sorgente: [gnulib]
Dettagli (2)
- 20250303-1 · amd64 · trixie
  Corretta · Corretta: 20140202+stable-3.1
  dsa · gnulib · debian · 13
- 20250303-1 · arm64 · trixie
  Corretta · Corretta: 20140202+stable-3.1
  dsa · gnulib · debian · 13
[gnulib]Corretta
Dettagli (2)
- 20250303-1 · all · trixie
  Corretta · Corretta: 20140202+stable-3.1
  dsa · gnulib · debian · 13
- 20250303-1 · all · trixie
  Corretta · Corretta: 20140202+stable-3.1
  dsa · gnulib · debian · 13

Osservato: Oct 23, 2026, 5:35:23 PM UTC

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]