{"id":"CVE-2018-11410","aliases":["DEBIAN-CVE-2018-11410","EUVD-2018-3441","GHSA-q952-frq9-cpf7","SUSE-SU-2019:0795-1","UBUNTU-CVE-2018-11410","USN-3669-1","openSUSE-SU-2019:1160-1","openSUSE-SU-2024:10953-1"],"status":"published","title":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in...","description":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04777,"percentile":0.91977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2018-05-24T00:00:00Z","modified":"2026-10-24T10:30:50Z","fixes":[{"ecosystem":"Debian:12","package":"liblouis","fixed_in":["3.5.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"liblouis","fixed_in":["3.5.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"liblouis","fixed_in":["3.5.0-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"liblouis","fixed_in":["3.5.0-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-4.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1ubuntu0.1"}]}],"versions":["3.0.0-3ubuntu1","3.3.0-1","3.4.1-1","3.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-2ubuntu1.3"}]}],"versions":["2.5.3-2","2.5.3-2ubuntu1","2.5.3-2ubuntu1.1","2.5.3-2ubuntu1.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-2ubuntu0.2"}]}],"versions":["2.6.2-2","2.6.4-2","2.6.4-2ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1ubuntu0.1"}]}],"versions":["3.0.0-3ubuntu1","3.3.0-1","3.4.1-1","3.5.0-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-lp150.3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-1.5"}]}],"bundled":9}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"liblouis","product":"liblouis"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1582024","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/3669-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/104324","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://docs.google.com/document/d/1Uw3D6ECXZr8S2cWOTY81kg6ivv0WpR4kQqxVpUSyGUA/edit?usp=sharing","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11410"},{"url":"https://github.com/advisories/GHSA-q952-frq9-cpf7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-11410","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190795-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1094685","tags":["report"]},{"url":"https://bugzilla.suse.com/1095189","tags":["report"]},{"url":"https://bugzilla.suse.com/1095825","tags":["report"]},{"url":"https://bugzilla.suse.com/1095826","tags":["report"]},{"url":"https://bugzilla.suse.com/1095827","tags":["report"]},{"url":"https://bugzilla.suse.com/1095945","tags":["report"]},{"url":"https://bugzilla.suse.com/1097103","tags":["report"]},{"url":"https://bugzilla.suse.com/1109319","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17294","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-11410","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3669-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11577","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QCDNK5Q6ITKQTT77S47V5FM4FO26BMI5/#QCDNK5Q6ITKQTT77S47V5FM4FO26BMI5","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13744","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-11410","description":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-05-24T07:00:00Z","modified":"2024-08-05T08:10:13.386Z","updated_at":"2026-11-02T14:35:09.570381Z"}],"euvd":[{"id":"EUVD-2018-3441","description":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-05-24T07:00:00Z","modified":"2024-08-05T08:10:13Z","updated_at":"2026-11-03T02:39:55.512487Z"}],"ghsa":[{"id":"GHSA-q952-frq9-cpf7","title":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in...","description":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2022-05-14T01:11:48Z","modified":"2023-02-02T05:03:25Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:51:38.289817Z"}],"nvd":[{"id":"CVE-2018-11410","description":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-05-24T07:29:00.347Z","modified":"2026-06-17T01:35:52.75Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"CVE-2018-11410","description":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-05-24T07:29:00.347Z","modified":"2026-10-24T10:30:50.441108837Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-11410","description":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-05-24T07:29:00.347Z","modified":"2026-10-23T18:03:46.809878544Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-11410","description":"An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.","status":"published","published":"2018-05-24T00:00:00Z","modified":"2026-04-22T11:42:00.866124Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"openSUSE-SU-2019:1160-1","title":"Security update for liblouis","description":"This update for liblouis fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-17294: Fixed an out of bounds read in matchCurrentInput function \n  which could allow a remote attacker to cause Denail of Service (bsc#1109319).\n- CVE-2018-11410: Fixed an invalid free in the compileRule function in\n  compileTranslationTable.c (bsc#1094685)\n- CVE-2018-11440: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (bsc#1095189)\n- CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c\n  (bsc#1095945)\n- CVE-2018-11683: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1095827)\n- CVE-2018-11684: Fixed stack-based buffer overflow in the function\n  includeFile() in compileTranslationTable.c (bsc#1095826)\n- CVE-2018-11685: Fixed a stack-based buffer overflow in the function\n  compileHyphenation() in compileTranslationTable.c (bsc#1095825)\n- CVE-2018-12085: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1097103)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-05T10:06:53Z","modified":"2026-02-04T03:56:06.836878Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10953-1","title":"liblouis-data-3.16.1-1.5 on GA media","description":"These are all security issues fixed in the liblouis-data-3.16.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:37:06.067622Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0795-1","title":"Security update for liblouis","description":"This update for liblouis fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-17294: Fixed an out of bounds read in matchCurrentInput function \n  which could allow a remote attacker to cause Denail of Service (bsc#1109319).\n- CVE-2018-11410: Fixed an invalid free in the compileRule function in\n  compileTranslationTable.c (bsc#1094685)\n- CVE-2018-11440: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (bsc#1095189)\n- CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c\n  (bsc#1095945)\n- CVE-2018-11683: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1095827)\n- CVE-2018-11684: Fixed stack-based buffer overflow in the function\n  includeFile() in compileTranslationTable.c (bsc#1095826)\n- CVE-2018-11685: Fixed a stack-based buffer overflow in the function\n  compileHyphenation() in compileTranslationTable.c (bsc#1095825)\n- CVE-2018-12085: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1097103)\n","status":"published","published":"2019-03-28T12:22:17Z","modified":"2026-02-04T02:15:09.356136Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3669-1","title":"liblouis vulnerabilities","description":"It was discovered that Liblouis incorrectly handled certain files.\nAn attacker could possibly use this to cause a denial of service.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2018-11410)\n\nIt was discovered that Liblouis incorrectly handled certain files.\nAn attacker could possibly use this to execute arbitrary code.\n(CVE-2018-11440)\n\nIt was discovered that Liblouis incorrectly handled certain files.\nAn attacker could possibly use this to cause a denial of service or\nexecute arbitrary code. (CVE-2018-11577)\n","status":"published","published":"2018-06-04T17:58:07Z","modified":"2026-04-22T09:46:22.238305Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}