CVE-2018-8754
libevt1: The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properl...
CVE-2018-8754 is fixed in 4 products on 1 platform, first by libevt-utils 20170120-2, released March 17, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0034
27th percentile
The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libevt-utils · Ubuntu 18.04.6 LTS (bionic) | 20170120-2 | libevt-utils 20170120-2 | Mar 17, 2018 |
| libevt1 · Ubuntu 18.04.6 LTS (bionic) | 20170120-2 | libevt1 20170120-2 | Mar 17, 2018 |
| python-libevt · Ubuntu 18.04.6 LTS (bionic) | 20170120-2 | python-libevt 20170120-2 | Mar 17, 2018 |
| python3-libevt · Ubuntu 18.04.6 LTS (bionic) | 20170120-2 | python3-libevt 20170120-2 | Mar 17, 2018 |