{"id":"CVE-2018-16982","aliases":["EUVD-2018-0150","GHSA-9qh2-6fxg-9m4g","MGASA-2018-0443","PYSEC-2018-153","SUSE-SU-2022:4288-1","SUSE-SU-2024:2102-1","UBUNTU-CVE-2018-16982"],"status":"published","title":"Open Chinese Convert subject to Denial of Service via Out-of-bounds Read","description":"Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01093,"percentile":0.65675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2018-09-13T02:00:00Z","modified":"2026-10-20T10:50:06Z","fixes":[{"ecosystem":"npm","package":"opencc","fixed_in":["1.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:6","package":"opencc","fixed_in":["1.0.3-3.1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"opencc","fixed_in":["1.0.3-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"opencc","fixed_in":["1.0.3-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"opencc","fixed_in":["1.0.3-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"opencc","fixed_in":["1.0.5-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"opencc","fixed_in":["1.0.5-150000.5.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"opencc","fixed_in":["1.0.5-150000.5.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"opencc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-150000.5.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.3-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.4-5","1.0.4-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opencc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.5-2","1.0.5+git20190530-1","1.0.5+git20190530-1build1","1.0.5+git20190530-1ubuntu0.1~esm1"]}],"products":[{"vendor":"byvoid","product":"open_chinese_convert"}],"references":[{"url":"https://github.com/BYVoid/OpenCC/issues/303","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence","web","report","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16982","tags":["advisory"]},{"url":"https://github.com/BYVoid/OpenCC/pull/309","tags":["web"]},{"url":"https://github.com/BYVoid/OpenCC/pull/560","tags":["web"]},{"url":"https://github.com/BYVoid/OpenCC/pull/560/commits/e1b8c7949738100e4747dd4109ef1f16e1bd99c4","tags":["web"]},{"url":"https://github.com/BYVoid/OpenCC/commit/4a4f9e58e505fca93605f22363c133df66a91a5e","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/opencc-py/PYSEC-2018-153.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9qh2-6fxg-9m4g"},{"url":"https://github.com/BYVoid/OpenCC","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2018-0443.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23764","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GDWZHBV4B3VZTM4ACXQMZKSLTIKFJUUO/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224288-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1108310","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16982","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242102-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-16982","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16982","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-16982","description":"Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.","status":"published","published":"2018-09-13T02:00:00Z","modified":"2024-09-17T04:23:53.341Z","updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-0150","description":"Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.","status":"published","published":"2018-09-13T02:00:00Z","modified":"2024-09-17T04:23:53Z","updated_at":"2026-11-03T00:28:23.50734Z"}],"ghsa":[{"id":"GHSA-9qh2-6fxg-9m4g","title":"Open Chinese Convert subject to Denial of Service via Out-of-bounds Read","description":"Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.","status":"published","published":"2022-05-14T01:55:28Z","modified":"2024-11-22T17:59:52Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:38:22.774145Z"}],"nvd":[{"id":"CVE-2018-16982","description":"Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.","status":"published","published":"2018-09-13T02:29:00.237Z","modified":"2026-06-17T01:45:10.317Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"CVE-2018-16982","description":"Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.","status":"published","published":"2018-09-13T02:29:00.237Z","modified":"2026-10-20T10:50:06.559030612Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"GHSA-9qh2-6fxg-9m4g","title":"Open Chinese Convert subject to Denial of Service via Out-of-bounds Read","description":"Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.","status":"published","published":"2022-05-14T01:55:28Z","modified":"2024-11-22T17:59:52Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"PYSEC-2018-153","description":"Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.","status":"withdrawn","published":"2018-09-13T02:29:00Z","modified":"2024-11-21T14:22:57.249534Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"UBUNTU-CVE-2018-16982","description":"Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.","status":"published","published":"2018-09-13T02:29:00Z","modified":"2026-05-26T21:30:06.392531391Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"MGASA-2018-0443","title":"Updated opencc packages fix security vulnerability","description":"It was discovered that opencc contained an out of bounds pointer in\nBinaryDict.cpp which could lead to segment fault and a Denial of Service\n(CVE-2018-16982).\n","status":"published","published":"2018-11-11T21:09:54Z","modified":"2026-04-16T06:26:24.039155645Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"SUSE-SU-2022:4288-1","title":"Security update for opencc","description":"This update for opencc fixes the following issues:\n\n- CVE-2018-16982: Fixed out-of-bounds keyOffset and valueOffset values in BinaryDict.cpp. (bsc#1108310)\n","status":"published","published":"2022-11-29T14:58:44Z","modified":"2026-02-04T04:13:28.224322Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2024:2102-1","title":"Security update for opencc","description":"This update for opencc fixes the following issues:\n\n- CVE-2018-16982: Check offset bounds in BinaryDict::NewFromFile method. (bsc#1108310)\n","status":"published","published":"2024-06-19T14:39:16Z","modified":"2026-02-04T03:21:46.926111Z","updated_at":"2026-11-02T15:53:54.652421Z"}]}}