{"id":"CVE-2018-11683","aliases":["DEBIAN-CVE-2018-11683","EUVD-2018-3703","GHSA-p7h6-mv5m-jff6","SUSE-SU-2018:2569-1","SUSE-SU-2018:2780-1","SUSE-SU-2019:0795-1","UBUNTU-CVE-2018-11683","USN-3672-1","openSUSE-SU-2019:1160-1","openSUSE-SU-2024:10953-1"],"status":"published","title":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in...","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0211,"percentile":0.81923,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2018-06-04T00:00:00Z","modified":"2026-10-23T18:02:57Z","fixes":[{"ecosystem":"Debian:12","package":"liblouis","fixed_in":["3.5.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"liblouis","fixed_in":["3.5.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"liblouis","fixed_in":["3.5.0-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"liblouis","fixed_in":["2.5.3-2ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"liblouis","fixed_in":["2.6.4-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"liblouis","fixed_in":["3.5.0-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"python-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"python-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.3.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"python3-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"python3-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"python3-louis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-6.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-4.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-2ubuntu1.4"}]}],"versions":["2.5.3-2","2.5.3-2ubuntu1","2.5.3-2ubuntu1.1","2.5.3-2ubuntu1.2","2.5.3-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-2ubuntu0.3"}]}],"versions":["2.6.2-2","2.6.4-2","2.6.4-2ubuntu0.1","2.6.4-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1ubuntu0.2"}]}],"versions":["3.0.0-3ubuntu1","3.3.0-1","3.4.1-1","3.5.0-1","3.5.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-2ubuntu1.4"}]}],"versions":["2.5.3-2","2.5.3-2ubuntu1","2.5.3-2ubuntu1.1","2.5.3-2ubuntu1.2","2.5.3-2ubuntu1.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-2ubuntu0.3"}]}],"versions":["2.6.2-2","2.6.4-2","2.6.4-2ubuntu0.1","2.6.4-2ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1ubuntu0.2"}]}],"versions":["3.0.0-3ubuntu1","3.3.0-1","3.4.1-1","3.5.0-1","3.5.0-1ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-lp150.3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"liblouis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-1.5"}]}],"bundled":9}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"liblouis","product":"liblouis"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://usn.ubuntu.com/3672-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/liblouis/liblouis/issues/591","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11683"},{"url":"https://github.com/advisories/GHSA-p7h6-mv5m-jff6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-11683","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182569-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1095825","tags":["report"]},{"url":"https://bugzilla.suse.com/1095826","tags":["report"]},{"url":"https://bugzilla.suse.com/1095827","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11685","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182780-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1095189","tags":["report"]},{"url":"https://bugzilla.suse.com/1095945","tags":["report"]},{"url":"https://bugzilla.suse.com/1097103","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12085","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190795-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1094685","tags":["report"]},{"url":"https://bugzilla.suse.com/1109319","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17294","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-11683","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3672-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11684","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11685","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QCDNK5Q6ITKQTT77S47V5FM4FO26BMI5/#QCDNK5Q6ITKQTT77S47V5FM4FO26BMI5","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13744","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-11683","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.","status":"published","published":"2018-06-04T06:00:00Z","modified":"2024-08-05T08:17:08.771Z","updated_at":"2026-11-02T14:35:09.570381Z"}],"euvd":[{"id":"EUVD-2018-3703","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.","status":"published","published":"2018-06-04T06:00:00Z","modified":"2024-08-05T08:17:08Z","updated_at":"2026-11-03T02:39:54.984528Z"}],"ghsa":[{"id":"GHSA-p7h6-mv5m-jff6","title":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in...","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.","status":"published","published":"2022-05-13T01:18:57Z","modified":"2023-02-01T05:05:35Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:15.84507Z"}],"nvd":[{"id":"CVE-2018-11683","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.","status":"published","published":"2018-06-04T06:29:00.497Z","modified":"2026-06-17T01:36:21.387Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:28.483469Z"}],"osv":[{"id":"CVE-2018-11683","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.","status":"published","published":"2018-06-04T06:29:00.497Z","modified":"2026-10-20T10:49:59.883381484Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-11683","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.","status":"published","published":"2018-06-04T06:29:00.497Z","modified":"2026-10-23T18:02:57.744976451Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-11683","description":"Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.","status":"published","published":"2018-06-04T00:00:00Z","modified":"2026-04-22T11:42:06.057472Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"openSUSE-SU-2019:1160-1","title":"Security update for liblouis","description":"This update for liblouis fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-17294: Fixed an out of bounds read in matchCurrentInput function \n  which could allow a remote attacker to cause Denail of Service (bsc#1109319).\n- CVE-2018-11410: Fixed an invalid free in the compileRule function in\n  compileTranslationTable.c (bsc#1094685)\n- CVE-2018-11440: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (bsc#1095189)\n- CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c\n  (bsc#1095945)\n- CVE-2018-11683: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1095827)\n- CVE-2018-11684: Fixed stack-based buffer overflow in the function\n  includeFile() in compileTranslationTable.c (bsc#1095826)\n- CVE-2018-11685: Fixed a stack-based buffer overflow in the function\n  compileHyphenation() in compileTranslationTable.c (bsc#1095825)\n- CVE-2018-12085: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1097103)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-05T10:06:53Z","modified":"2026-02-04T03:56:06.836878Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10953-1","title":"liblouis-data-3.16.1-1.5 on GA media","description":"These are all security issues fixed in the liblouis-data-3.16.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:37:06.067622Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:2569-1","title":"Security update for liblouis","description":"This update for liblouis, python-louis fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-11684: Fixed stack-based buffer overflow in the function\n  includeFile() in compileTranslationTable.c (bsc#1095826)\n- CVE-2018-11685: Fixed a stack-based buffer overflow in the function\n  compileHyphenation() in compileTranslationTable.c (bsc#1095825)\n- CVE-2018-11683: Fix a stack-based buffer overflow in the function parseChars()\n  in compileTranslationTable.c (bsc#1095827)\n","status":"published","published":"2018-08-31T07:12:00Z","modified":"2026-02-04T02:14:18.555706Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2780-1","title":"Security update for liblouis","description":"This update for liblouis, python-louis, python3-louis fixes the\nfollowing issues:\n\nSecurity issues fixed:\n\n- CVE-2018-11440: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (bsc#1095189)\n- CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c\n  (bsc#1095945)\n- CVE-2018-11683: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1095827)\n- CVE-2018-11684: Fixed stack-based buffer overflow in the function\n  includeFile() in compileTranslationTable.c (bsc#1095826)\n- CVE-2018-11685: Fixed a stack-based buffer overflow in the function\n  compileHyphenation() in compileTranslationTable.c (bsc#1095825)\n- CVE-2018-12085: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1097103)\n","status":"published","published":"2018-09-21T05:52:13Z","modified":"2026-02-04T02:15:10.672488Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2019:0795-1","title":"Security update for liblouis","description":"This update for liblouis fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-17294: Fixed an out of bounds read in matchCurrentInput function \n  which could allow a remote attacker to cause Denail of Service (bsc#1109319).\n- CVE-2018-11410: Fixed an invalid free in the compileRule function in\n  compileTranslationTable.c (bsc#1094685)\n- CVE-2018-11440: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (bsc#1095189)\n- CVE-2018-11577: Fixed a segmentation fault in lou_logPrint in logging.c\n  (bsc#1095945)\n- CVE-2018-11683: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1095827)\n- CVE-2018-11684: Fixed stack-based buffer overflow in the function\n  includeFile() in compileTranslationTable.c (bsc#1095826)\n- CVE-2018-11685: Fixed a stack-based buffer overflow in the function\n  compileHyphenation() in compileTranslationTable.c (bsc#1095825)\n- CVE-2018-12085: Fixed a stack-based buffer overflow in the function\n  parseChars() in compileTranslationTable.c (different vulnerability than\n  CVE-2018-11440) (bsc#1097103)\n","status":"published","published":"2019-03-28T12:22:17Z","modified":"2026-02-04T02:15:09.356136Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3672-1","title":"liblouis vulnerabilities","description":"Henri Salo discovered that Liblouis incorrectly handled certain files.\nAn attacker could possibly use this to execute arbitrary code.\n(CVE-2018-11683, CVE-2018-11684, CVE-2018-11685)\n","status":"published","published":"2018-06-06T15:09:47Z","modified":"2026-04-22T09:45:41.453271Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}