{
  "cveId": "CVE-2018-14779",
  "url": "https://patchblox.com/security/cve/CVE-2018-14779",
  "summary": "CVE-2018-14779 is fixed in 3 products on 1 platform, first by libykpiv1 1.4.2-2ubuntu0.1, released August 15, 2018. It is not reported as exploited. Patch Radar priority: High.",
  "title": "libykpiv1: A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver",
  "description": "A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function \u0060ykpiv_transfer_data()\u0060: {% highlight c %} if(*out_len \u002B recv_len - 2 \u0026gt; max_out) { fprintf(stderr, \u0022Output buffer to small, wanted to write %lu, max was %lu.\u0022, *out_len \u002B recv_len - 2, max_out); } if(out_data) { memcpy(out_data, data, recv_len - 2); out_data \u002B= recv_len - 2; *out_len \u002B= recv_len - 2; } {% endhighlight %} -- it is clearly checked whether the buffer is big enough to hold the data copied using \u0060memcpy()\u0060, but no error handling happens to avoid the \u0060memcpy()\u0060 in such cases. This code path can be triggered with malicious data coming from a smartcard.",
  "published": "2018-08-15T11:29:00Z",
  "severity": "High",
  "epss": 0.00491,
  "epssPercentile": 0.42424,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libykpiv1",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.4.2-2ubuntu0.1",
      "fix": "libykpiv1 1.4.2-2ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libykpiv1-1.4.2-2ubuntu0.1",
      "released": "2018-08-15T11:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ykcs11",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.4.2-2ubuntu0.1",
      "fix": "ykcs11 1.4.2-2ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ykcs11-1.4.2-2ubuntu0.1",
      "released": "2018-08-15T11:29:00Z"
    },
    {
      "platform": "linux",
      "product": "yubico-piv-tool",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.4.2-2ubuntu0.1",
      "fix": "yubico-piv-tool 1.4.2-2ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-yubico-piv-tool-1.4.2-2ubuntu0.1",
      "released": "2018-08-15T11:29:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}