{"id":"CVE-2018-11440","aliases":["DEBIAN-CVE-2018-11440","EUVD-2018-3471","GHSA-xwv4-cq25-qmfg","SUSE-SU-2018:2780-1","SUSE-SU-2019:0795-1","UBUNTU-CVE-2018-11440","USN-3669-1","openSUSE-SU-2019:1160-1"],"status":"published","title":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in...","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03023,"percentile":0.87555,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2018-05-25T00:00:00Z","modified":"2026-10-23T18:03:35Z","fixes":[{"ecosystem":"Debian:12","package":"liblouis","fixed_in":["3.5.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"liblouis","fixed_in":["3.5.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"liblouis","fixed_in":["3.5.0-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"liblouis","fixed_in":["2.5.3-2ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"liblouis","fixed_in":["2.6.4-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"liblouis","fixed_in":["3.5.0-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python3-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python3-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python3-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-4.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-2ubuntu1.3"}]}],"versions":["2.5.3-2","2.5.3-2ubuntu1","2.5.3-2ubuntu1.1","2.5.3-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-2ubuntu0.2"}]}],"versions":["2.6.2-2","2.6.4-2","2.6.4-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1ubuntu0.1"}]}],"versions":["3.0.0-3ubuntu1","3.3.0-1","3.4.1-1","3.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-2ubuntu1.3"}]}],"versions":["2.5.3-2","2.5.3-2ubuntu1","2.5.3-2ubuntu1.1","2.5.3-2ubuntu1.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-2ubuntu0.2"}]}],"versions":["2.6.2-2","2.6.4-2","2.6.4-2ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1ubuntu0.1"}]}],"versions":["3.0.0-3ubuntu1","3.3.0-1","3.4.1-1","3.5.0-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-lp150.3.3.1"}]}],"bundled":8}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"liblouis","product":"liblouis"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://usn.ubuntu.com/3669-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/104321","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/liblouis/liblouis/issues/575","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11440"},{"url":"https://github.com/advisories/GHSA-xwv4-cq25-qmfg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-11440","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182780-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1095189","tags":["report"]},{"url":"https://bugzilla.suse.com/1095825","tags":["report"]},{"url":"https://bugzilla.suse.com/1095826","tags":["report"]},{"url":"https://bugzilla.suse.com/1095827","tags":["report"]},{"url":"https://bugzilla.suse.com/1095945","tags":["report"]},{"url":"https://bugzilla.suse.com/1097103","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12085","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190795-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1094685","tags":["report"]},{"url":"https://bugzilla.suse.com/1109319","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17294","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-11440","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3669-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11440","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11577","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QCDNK5Q6ITKQTT77S47V5FM4FO26BMI5/#QCDNK5Q6ITKQTT77S47V5FM4FO26BMI5","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-11440","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.","status":"published","published":"2018-05-25T11:00:00Z","modified":"2024-08-05T08:10:14.47Z","updated_at":"2026-11-02T14:35:09.570381Z"}],"euvd":[{"id":"EUVD-2018-3471","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.","status":"published","published":"2018-05-25T11:00:00Z","modified":"2024-08-05T08:10:14Z","updated_at":"2026-11-03T02:39:55.512487Z"}],"ghsa":[{"id":"GHSA-xwv4-cq25-qmfg","title":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in...","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.","status":"published","published":"2022-05-13T01:18:55Z","modified":"2023-02-01T05:05:25Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:14.84305Z"}],"nvd":[{"id":"CVE-2018-11440","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.","status":"published","published":"2018-05-25T11:29:00.217Z","modified":"2026-06-17T01:35:56.393Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"CVE-2018-11440","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.","status":"published","published":"2018-05-25T11:29:00.217Z","modified":"2026-10-20T10:50:17.366033807Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-11440","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.","status":"published","published":"2018-05-25T11:29:00.217Z","modified":"2026-10-23T18:03:35.842466726Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-11440","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.","status":"published","published":"2018-05-25T00:00:00Z","modified":"2026-04-22T11:42:05.749466Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"openSUSE-SU-2019:1160-1","title":"Security update for liblouis","description":"This update for liblouis fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-17294: Fixed an out of bounds read in matchCurrentInput function \n  which could allow a remote attacker to cause Denail of Service (bsc#1109319).\n- CVE-2018-11410: Fixed an invalid free in the compileRule function in\n  compileTranslationTable.c (bsc#1094685)\n- CVE-2018-11440: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (bsc#1095189)\n- CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c\n  (bsc#1095945)\n- CVE-2018-11683: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1095827)\n- CVE-2018-11684: Fixed stack-based buffer overflow in the function\n  includeFile() in compileTranslationTable.c (bsc#1095826)\n- CVE-2018-11685: Fixed a stack-based buffer overflow in the function\n  compileHyphenation() in compileTranslationTable.c (bsc#1095825)\n- CVE-2018-12085: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1097103)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-05T10:06:53Z","modified":"2026-02-04T03:56:06.836878Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"SUSE-SU-2018:2780-1","title":"Security update for liblouis","description":"This update for liblouis, python-louis, python3-louis fixes the\nfollowing issues:\n\nSecurity issues fixed:\n\n- CVE-2018-11440: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (bsc#1095189)\n- CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c\n  (bsc#1095945)\n- CVE-2018-11683: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1095827)\n- CVE-2018-11684: Fixed stack-based buffer overflow in the function\n  includeFile() in compileTranslationTable.c (bsc#1095826)\n- CVE-2018-11685: Fixed a stack-based buffer overflow in the function\n  compileHyphenation() in compileTranslationTable.c (bsc#1095825)\n- CVE-2018-12085: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1097103)\n","status":"published","published":"2018-09-21T05:52:13Z","modified":"2026-02-04T02:15:10.672488Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2019:0795-1","title":"Security update for liblouis","description":"This update for liblouis fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-17294: Fixed an out of bounds read in matchCurrentInput function \n  which could allow a remote attacker to cause Denail of Service (bsc#1109319).\n- CVE-2018-11410: Fixed an invalid free in the compileRule function in\n  compileTranslationTable.c (bsc#1094685)\n- CVE-2018-11440: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (bsc#1095189)\n- CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c\n  (bsc#1095945)\n- CVE-2018-11683: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1095827)\n- CVE-2018-11684: Fixed stack-based buffer overflow in the function\n  includeFile() in compileTranslationTable.c (bsc#1095826)\n- CVE-2018-11685: Fixed a stack-based buffer overflow in the function\n  compileHyphenation() in compileTranslationTable.c (bsc#1095825)\n- CVE-2018-12085: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1097103)\n","status":"published","published":"2019-03-28T12:22:17Z","modified":"2026-02-04T02:15:09.356136Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3669-1","title":"liblouis vulnerabilities","description":"It was discovered that Liblouis incorrectly handled certain files.\nAn attacker could possibly use this to cause a denial of service.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2018-11410)\n\nIt was discovered that Liblouis incorrectly handled certain files.\nAn attacker could possibly use this to execute arbitrary code.\n(CVE-2018-11440)\n\nIt was discovered that Liblouis incorrectly handled certain files.\nAn attacker could possibly use this to cause a denial of service or\nexecute arbitrary code. (CVE-2018-11577)\n","status":"published","published":"2018-06-04T17:58:07Z","modified":"2026-04-22T09:46:22.238305Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}