{"id":"CVE-2018-17942","aliases":["DEBIAN-CVE-2018-17942","DLA-1543-1","EUVD-2018-9683","GHSA-xwh4-p62h-wq65","MGASA-2019-0022","OESA-2022-1558","OESA-2022-2089","OESA-2025-1051","UBUNTU-CVE-2018-17942"],"status":"published","title":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based...","description":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\\0' character during %f processing.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02891,"percentile":0.8702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2018-10-03T08:00:00Z","modified":"2026-10-23T18:03:02Z","fixes":[{"ecosystem":"Debian:12","package":"gnulib","fixed_in":["20140202+stable-3.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnulib","fixed_in":["20140202+stable-3.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnulib","fixed_in":["20140202+stable-3.1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"gnulib","fixed_in":["20140202+stable-2+deb8u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"gnulib","fixed_in":["0-29.20180720git.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"gnulib","fixed_in":["0-29.20180720git.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"gnulib","fixed_in":["0-29.20180720git.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"gnulib","fixed_in":["0-29.20180720git.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"enscript","fixed_in":["1.6.6-22.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"enscript","fixed_in":["1.6.6-22.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"enscript","fixed_in":["1.6.6-22.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"enscript","fixed_in":["1.6.6-22.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"enscript","fixed_in":["1.6.6-22.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"gnulib","fixed_in":["20140202+stable-2+deb8u1build0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"gnulib","fixed_in":["20140202+stable-2+deb8u1build0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140202+stable-3.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140202+stable-3.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140202+stable-3.1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140202+stable-2+deb8u1"}]}],"versions":["20140202+stable-2"]},{"source":"osv","ecosystem":"Mageia:6","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.25-3.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-29.20180720git.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-29.20180720git.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-29.20180720git.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-29.20180720git.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"enscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-22.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"enscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-22.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"enscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-22.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"enscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-22.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"enscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-22.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140202+stable-2+deb8u1build0.16.04.1"}]}],"versions":["20140202+stable-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnulib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20140202+stable-2+deb8u1build0.18.04.1"}]}],"versions":["20140202+stable-2","20140202+stable-2build1"]}],"products":[{"vendor":"gnu","product":"gnulib"}],"references":[{"url":"https://github.com/coreutils/gnulib/commit/278b4175c9d7dd47c1a3071554aac02add3b3c35","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://savannah.gnu.org/bugs/?func=detailitem\u0026item_id=54686","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence","report"]},{"url":"https://lists.gnu.org/archive/html/bug-gnulib/2018-09/msg00107.html","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Vendor Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5UQRNQE6XHMD5UYYHAU3VQWAYHIPMQS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMGHTVYH3KAFN34QXNSGEQDSTV7MCOQW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17942","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5UQRNQE6XHMD5UYYHAU3VQWAYHIPMQS/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMGHTVYH3KAFN34QXNSGEQDSTV7MCOQW/"},{"url":"https://github.com/advisories/GHSA-xwh4-p62h-wq65"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-17942","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0022.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23825","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JK2ISMPYUEU3JS3L7AVXEHWCI56INCJJ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4ZP6L5HXDOVKYTM5ELLYE64H75MT4LZR/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22495","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1558","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2089","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1051","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-17942","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-17942","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-17942","description":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\\0' character during %f processing.","status":"published","published":"2018-10-03T08:00:00Z","modified":"2024-08-05T11:01:14.605Z","updated_at":"2026-11-02T14:35:07.672841Z"}],"euvd":[{"id":"EUVD-2018-9683","description":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\\0' character during %f processing.","status":"published","published":"2018-10-03T08:00:00Z","modified":"2024-08-05T11:01:14Z","updated_at":"2026-11-03T02:39:37.172177Z"}],"ghsa":[{"id":"GHSA-xwh4-p62h-wq65","title":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based...","description":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\\0' character during %f processing.","status":"published","published":"2022-05-13T01:19:30Z","modified":"2023-02-01T05:05:57Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:50:17.937177Z"}],"nvd":[{"id":"CVE-2018-17942","description":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\\0' character during %f processing.","status":"published","published":"2018-10-03T08:29:00.43Z","modified":"2026-06-17T01:46:34.52Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:42.52179Z"}],"osv":[{"id":"CVE-2018-17942","description":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\\0' character during %f processing.","status":"published","published":"2018-10-03T08:29:00.43Z","modified":"2026-10-20T13:44:52.47443371Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-17942","description":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\\0' character during %f processing.","status":"published","published":"2018-10-03T08:29:00.43Z","modified":"2026-10-23T18:03:02.516814888Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"OESA-2022-1558","title":"gnulib security update","description":"Gnulib is a central location for common GNU code, intended to be shared among GNU packages. It can be used to improve portability and other functionality in your programs.\r\n\r\nSecurity Fix(es):\r\n\r\nThe convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing \u0026apos;\\0\u0026apos; character during %f processing.(CVE-2018-17942)","status":"published","published":"2022-03-07T11:04:50Z","modified":"2026-08-18T01:16:25.125269064Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-2089","title":"gnulib security update","description":"Gnulib is a central location for common GNU code, intended to be shared among GNU packages. It can be used to improve portability and other functionality in your programs.\r\n\r\nSecurity Fix(es):\r\n\r\nThe convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing \u0026apos;\\0\u0026apos; character during %f processing.(CVE-2018-17942)","status":"published","published":"2022-11-11T11:05:24Z","modified":"2026-08-18T01:17:26.849176259Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2025-1051","title":"enscript security update","description":"GNU enscript is a computer program that converts text files to PostScript, RTF, or HTML formats. If no input files are given, enscript processes standard input. Enscript can be extended to handle different output media and it has many options which can be used to customize print-outs.\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2018-17942)","status":"published","published":"2025-01-17T11:08:08Z","modified":"2026-08-18T01:18:45.109904993Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2018-17942","description":"The convert_to_decimal function in vasnprintf.c in Gnulib before 2018-09-23 has a heap-based buffer overflow because memory is not allocated for a trailing '\\0' character during %f processing.","status":"published","published":"2018-10-03T08:29:00Z","modified":"2026-03-24T10:45:43.554573Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1543-1","title":"gnulib - security update","status":"published","published":"2018-10-10T00:00:00Z","modified":"2026-03-09T01:02:01.021256Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2019-0022","title":"Updated coreutils packages fix security vulnerabilities","description":"A flaw was found in GNU Coreutils through 8.29 in chown-core.c. The\nfunctions chown and chgrp do not prevent replacement of a plain file\nwith a symlink during use of the POSIX \"-R -L\" options, which allows\nlocal users to modify the ownership of arbitrary files by leveraging a\nrace condition (CVE-2017-18018).\n\nA flaw was found in Gnulib before 2018-09-23. The convert_to_decimal\nfunction in vasnprintf.c has a heap-based buffer overflow because memory\nis not allocated for a trailing '\\0' character during %f processing\n(CVE-2018-17942).\n","status":"published","published":"2019-01-08T21:50:23Z","modified":"2026-04-16T06:23:30.800623954Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}