{
  "cveId": "CVE-2018-14780",
  "url": "https://patchblox.com/security/cve/CVE-2018-14780",
  "summary": "CVE-2018-14780 is fixed in 3 products on 1 platform, first by libykpiv1 1.4.2-2ubuntu0.1, released August 15, 2018. It is not reported as exploited. Patch Radar priority: High.",
  "title": "libykpiv1: An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver",
  "description": "An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function \u0060_ykpiv_fetch_object()\u0060: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data \u002B 1, \u0026amp;outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data \u002B 1 \u002B offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a \u0060memmove()\u0060 occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the \u0060memmove()\u0060 could copy bytes behind the allocated data buffer into this buffer.",
  "published": "2018-08-15T11:29:00Z",
  "severity": "High",
  "epss": 0.00449,
  "epssPercentile": 0.39206,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libykpiv1",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.4.2-2ubuntu0.1",
      "fix": "libykpiv1 1.4.2-2ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libykpiv1-1.4.2-2ubuntu0.1",
      "released": "2018-08-15T11:29:00Z"
    },
    {
      "platform": "linux",
      "product": "ykcs11",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.4.2-2ubuntu0.1",
      "fix": "ykcs11 1.4.2-2ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ykcs11-1.4.2-2ubuntu0.1",
      "released": "2018-08-15T11:29:00Z"
    },
    {
      "platform": "linux",
      "product": "yubico-piv-tool",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.4.2-2ubuntu0.1",
      "fix": "yubico-piv-tool 1.4.2-2ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-yubico-piv-tool-1.4.2-2ubuntu0.1",
      "released": "2018-08-15T11:29:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T12:40:37Z"
}