p PatchFirst

CVE-2018-18765

CVE-2018-18765

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.

CVSS 9.1 · Critical · EPSS 1.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • smplayer Debian:12

    Affected ranges
    • ECOSYSTEM: < 18.5.0~ds1-1

    Update to 18.5.0~ds1-1

  • smplayer Debian:13

    Affected ranges
    • ECOSYSTEM: < 18.5.0~ds1-1

    Update to 18.5.0~ds1-1

  • smplayer Debian:14

    Affected ranges
    • ECOSYSTEM: < 18.5.0~ds1-1

    Update to 18.5.0~ds1-1

Original sources

Check your server →