{"id":"CVE-2018-25033","aliases":["DEBIAN-CVE-2018-25033","DLA-3019-1","EUVD-2022-0001","GHSA-5jrq-582v-9767","MGASA-2022-0209","PYSEC-2022-182","UBUNTU-CVE-2018-25033"],"status":"published","title":"Out-of-bounds read in admesh","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01067,"percentile":0.65016,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-05-08T05:03:10Z","modified":"2026-10-23T18:04:47Z","fixes":[{"ecosystem":"PyPI","package":"admesh","fixed_in":["0.98.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"admesh","fixed_in":["0.98.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"admesh","fixed_in":["0.98.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"admesh","fixed_in":["0.98.4-2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"admesh","fixed_in":["0.98.2-3+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"admesh","fixed_in":["0.98.4-2.1.mga8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.4-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.2-3+deb9u1"}]}],"versions":["0.98.2-3"]},{"source":"osv","ecosystem":"PyPI","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.5"}]}],"versions":["0.96","0.98","0.98.1","0.98.2","0.98.3","0.98.4","0.98a1"]},{"source":"osv","ecosystem":"Mageia:8","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.4-2.1.mga8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.98.5"}]}],"versions":["0.96","0.98","0.98.1","0.98.2","0.98.3","0.98.4","0.98a1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.3-1ubuntu1","0.98.3-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.3-4","0.98.4-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.4-2","0.98.5-1","0.98.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.5-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"admesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98.5-1build1","0.98.5-1build2"]}],"products":[{"vendor":"admesh_project","product":"admesh"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://github.com/admesh/admesh/issues/28","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25033","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5jrq-582v-9767","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/admesh/PYSEC-2022-182.yaml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-25033","tags":["advisory"]},{"url":"https://github.com/admesh/admesh","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0209.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30466","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-3019","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-25033","tags":["report"]},{"url":"https://github.com/admesh/admesh/commit/e84d8353f1347e1f26f0a95770d92ba14e6ede38","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-25033","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-25033","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","status":"published","published":"2022-05-08T05:03:10Z","modified":"2024-08-05T12:26:39.623Z","updated_at":"2026-11-02T14:35:01.952568Z"}],"euvd":[{"id":"EUVD-2022-0001","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","status":"published","published":"2022-05-08T05:03:10Z","modified":"2024-08-05T12:26:39Z","updated_at":"2026-11-03T02:39:27.400094Z"}],"ghsa":[{"id":"GHSA-5jrq-582v-9767","title":"Out-of-bounds read in admesh","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","status":"published","published":"2022-05-09T00:00:51Z","modified":"2023-01-29T05:01:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:36:25.064927Z"}],"nvd":[{"id":"CVE-2018-25033","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","status":"published","published":"2022-05-08T06:15:06.92Z","modified":"2026-06-17T01:54:33.997Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:00.565712Z"}],"osv":[{"id":"CVE-2018-25033","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","status":"published","published":"2022-05-08T06:15:06.92Z","modified":"2026-10-20T10:48:10.081175021Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-25033","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","status":"published","published":"2022-05-08T06:15:06.92Z","modified":"2026-10-23T18:04:47.661870992Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"GHSA-5jrq-582v-9767","title":"Out-of-bounds read in admesh","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","status":"published","published":"2022-05-09T00:00:51Z","modified":"2023-11-08T04:00:15.219347Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"UBUNTU-CVE-2018-25033","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","status":"published","published":"2022-05-08T06:15:00Z","modified":"2026-10-17T12:55:26.242239765Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"DLA-3019-1","title":"admesh - security update","status":"published","published":"2022-05-22T00:00:00Z","modified":"2026-03-09T01:21:03.958501Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0209","title":"Updated admesh packages fix security vulnerability","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in\nstl_update_connects_remove_1 (called from stl_remove_degenerate) in\nconnect.c in libadmesh.a. (CVE-2018-25033)\n","status":"published","published":"2022-05-28T08:56:13Z","modified":"2026-04-16T04:41:53.711868486Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"PYSEC-2022-182","description":"ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.","status":"published","published":"2022-05-08T06:15:00Z","modified":"2023-11-08T04:00:15.219347Z","updated_at":"2026-11-02T15:52:53.449407Z"}]}}