ID CVE-2018-17848
Summary The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.
References
Vulnerable Configurations
  • cpe:2.3:a:golang:net:2018-07-02:*:*:*:*:*:*:*
    cpe:2.3:a:golang:net:2018-07-02:*:*:*:*:*:*:*
  • cpe:2.3:a:golang:net:2018-07-06:*:*:*:*:*:*:*
    cpe:2.3:a:golang:net:2018-07-06:*:*:*:*:*:*:*
  • cpe:2.3:a:golang:net:2018-07-09:*:*:*:*:*:*:*
    cpe:2.3:a:golang:net:2018-07-09:*:*:*:*:*:*:*
  • cpe:2.3:a:golang:net:2018-07-10:*:*:*:*:*:*:*
    cpe:2.3:a:golang:net:2018-07-10:*:*:*:*:*:*:*
  • cpe:2.3:a:golang:net:2018-07-12:*:*:*:*:*:*:*
    cpe:2.3:a:golang:net:2018-07-12:*:*:*:*:*:*:*
  • cpe:2.3:a:golang:net:2018-09-11:*:*:*:*:*:*:*
    cpe:2.3:a:golang:net:2018-09-11:*:*:*:*:*:*:*
  • cpe:2.3:a:golang:net:2018-09-17:*:*:*:*:*:*:*
    cpe:2.3:a:golang:net:2018-09-17:*:*:*:*:*:*:*
  • cpe:2.3:a:golang:net:2018-09-21:*:*:*:*:*:*:*
    cpe:2.3:a:golang:net:2018-09-21:*:*:*:*:*:*:*
  • cpe:2.3:a:golang:net:2018-09-25:*:*:*:*:*:*:*
    cpe:2.3:a:golang:net:2018-09-25:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 02-06-2020 - 20:45)
Impact:
Exploitability:
CWE CWE-129
CAPEC
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
refmap via4
fedora
  • FEDORA-2019-07d447a1d3
  • FEDORA-2019-07e8e806e0
misc https://github.com/golang/go/issues/27846
Last major update 02-06-2020 - 20:45
Published 01-10-2018 - 08:29
Last modified 02-06-2020 - 20:45
Back to Top