Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

CVE-2018-11723 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2018-11723

CVE-2018-11723

MEDIUM5.5

The libpff_name_to_id_map_entry_read function in libpff_name_to_id_map

Published Jun 19, 2018

Modified 1 years ago

Details

The libpff_name_to_id_map_entry_read function in libpff_name_to_id_map.c in libyal libpff through 2018-04-28 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted pff file. NOTE: the vendor has disputed this as described in libyal/libpff issue 66 on GitHub

References

http://packetstormsecurity.com/files/148113/libpff-2018-04-28-Information-Disclosure.html

http://seclists.org/fulldisclosure/2018/Jun/15

https://www.cve.org/CVERecord?id=CVE-2018-11723

CVSS Analysis

CVSS v3.0

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

5.5/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Ecosystems

Timeline

PublishedJun 19, 2018

ModifiedAug 5, 2024