{"id":"CVE-2018-8882","aliases":["DEBIAN-CVE-2018-8882","EUVD-2018-20490","GHSA-3pgv-pw29-xppm","SUSE-SU-2020:1843-1","UBUNTU-CVE-2018-8882","openSUSE-SU-2020:0952-1","openSUSE-SU-2020:0954-1"],"status":"published","title":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr...","description":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00371,"percentile":0.31281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2018-03-20T23:00:00Z","modified":"2026-10-24T10:30:39Z","fixes":[{"ecosystem":"Debian:12","package":"nasm","fixed_in":["2.14-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nasm","fixed_in":["2.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nasm","fixed_in":["2.14-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.02-3.4.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.02-3.4.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.06-1really2.11.05-1","2.11.08-1","2.11.08-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13.01-2","2.13.02-0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.02-lp151.3.3.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.02-lp152.4.3.1"}]}],"bundled":13}],"products":[{"vendor":"nasm","product":"netwide_assembler"}],"references":[{"url":"https://bugzilla.nasm.us/show_bug.cgi?id=3392445","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00017.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8882"},{"url":"https://github.com/advisories/GHSA-3pgv-pw29-xppm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-8882","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201843-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084631","tags":["report"]},{"url":"https://bugzilla.suse.com/1086186","tags":["report"]},{"url":"https://bugzilla.suse.com/1086227","tags":["report"]},{"url":"https://bugzilla.suse.com/1086228","tags":["report"]},{"url":"https://bugzilla.suse.com/1090519","tags":["report"]},{"url":"https://bugzilla.suse.com/1090840","tags":["report"]},{"url":"https://bugzilla.suse.com/1106878","tags":["report"]},{"url":"https://bugzilla.suse.com/1107592","tags":["report"]},{"url":"https://bugzilla.suse.com/1107594","tags":["report"]},{"url":"https://bugzilla.suse.com/1108404","tags":["report"]},{"url":"https://bugzilla.suse.com/1115758","tags":["report"]},{"url":"https://bugzilla.suse.com/1115774","tags":["report"]},{"url":"https://bugzilla.suse.com/1115795","tags":["report"]},{"url":"https://bugzilla.suse.com/1173538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8883","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-8882","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-8882","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DOJ3G66H5CLZFCUKGB4363DLYQJJULTG/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W7JG7QO2J6GPYXBPONYRKYBTFH2XDJZJ/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-8882","description":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.","status":"published","published":"2018-03-20T23:00:00Z","modified":"2024-08-05T07:10:46.54Z","updated_at":"2026-11-02T14:35:04.172099Z"}],"euvd":[{"id":"EUVD-2018-20490","description":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.","status":"published","published":"2018-03-20T23:00:00Z","modified":"2024-08-05T07:10:46Z","updated_at":"2026-11-03T02:40:01.4233Z"}],"ghsa":[{"id":"GHSA-3pgv-pw29-xppm","title":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr...","description":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.","status":"published","published":"2022-05-13T01:25:21Z","modified":"2023-02-01T05:07:24Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:32.348028Z"}],"nvd":[{"id":"CVE-2018-8882","description":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.","status":"published","published":"2018-03-20T23:29:00.297Z","modified":"2026-06-17T02:05:34.89Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:24.264003Z"}],"osv":[{"id":"CVE-2018-8882","description":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.","status":"published","published":"2018-03-20T23:29:00.297Z","modified":"2026-10-24T10:30:39.796488523Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2018-8882","description":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.","status":"published","published":"2018-03-20T23:29:00.297Z","modified":"2026-10-23T18:03:09.623584289Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2018-8882","description":"Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.","status":"published","published":"2018-03-20T23:29:00Z","modified":"2026-04-27T15:55:26.149444Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"openSUSE-SU-2020:0952-1","title":"Security update for nasm","description":"\nThis update for nasm fixes the following issues:\n\nnasm was updated to version 2.14.02.\n\nThis allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes\nand improvements.\n\n* Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified.\n* Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before).\n* If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7.\n* Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code.\n* Fix a corner case in the floating-point code where a binary, octal or\n  hexadecimal floating-point having at least 32, 11, or 8 mantissa digits\n  could produce slightly incorrect results under very specific conditions.\n* Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7.\n* Fix -E in combination with -MD. See section 2.1.21.\n* Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug.\n* Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.)\n* Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1.\n* Changed -I option semantics by adding a trailing path separator unconditionally.\n* Fixed null dereference in corrupted invalid single line macros.\n* Fixed division by zero which may happen if source code is malformed.\n* Fixed out of bound access in processing of malformed segment override.\n* Fixed out of bound access in certain EQU parsing.\n* Fixed buffer underflow in float parsing.\n* Added SGX (Intel Software Guard Extensions) instructions.\n* Added +n syntax for multiple contiguous registers.\n* Fixed subsections_via_symbols for macho object format.\n* Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28.\n* Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9.\n* Supported generic %pragma namespaces, output and debug. See section 6.10.\n* Added the --pragma command line option to inject a %pragma directive. See section 2.1.29.\n* Added the --before command line option to accept preprocess statement before input. See section 2.1.30.\n* Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions.\n* Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8.\n* Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5.\n* The GLOBAL directive no longer is required to precede the definition of the symbol.\n* Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5.\n* Updated UD0 encoding to match with the specification\n* Added the --limit-X command line option to set execution limits. See section 2.1.31.\n* Updated the Codeview version number to be aligned with MASM.\n* Added the --keep-all command line option to preserve output files. See section 2.1.32.\n* Added the --include command line option, an alias to -P (section 2.1.18).\n* Added the --help command line option as an alias to -h (section 3.1).\n* Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64.\n\nNew upstream version 2.13.03:\n\n* Add flags: AES, VAES, VPCLMULQDQ\n* Add VPCLMULQDQ instruction\n* elf: Add missing dwarf loc section\n* documentation updates\n  \nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-13T14:30:07Z","modified":"2026-02-04T02:13:04.406377Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0954-1","title":"Security update for nasm","description":"\nThis update for nasm fixes the following issues:\n\nnasm was updated to version 2.14.02.\n\nThis allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes\nand improvements.\n\n* Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified.\n* Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before).\n* If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7.\n* Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code.\n* Fix a corner case in the floating-point code where a binary, octal or\n  hexadecimal floating-point having at least 32, 11, or 8 mantissa digits\n  could produce slightly incorrect results under very specific conditions.\n* Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7.\n* Fix -E in combination with -MD. See section 2.1.21.\n* Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug.\n* Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.)\n* Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1.\n* Changed -I option semantics by adding a trailing path separator unconditionally.\n* Fixed null dereference in corrupted invalid single line macros.\n* Fixed division by zero which may happen if source code is malformed.\n* Fixed out of bound access in processing of malformed segment override.\n* Fixed out of bound access in certain EQU parsing.\n* Fixed buffer underflow in float parsing.\n* Added SGX (Intel Software Guard Extensions) instructions.\n* Added +n syntax for multiple contiguous registers.\n* Fixed subsections_via_symbols for macho object format.\n* Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28.\n* Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9.\n* Supported generic %pragma namespaces, output and debug. See section 6.10.\n* Added the --pragma command line option to inject a %pragma directive. See section 2.1.29.\n* Added the --before command line option to accept preprocess statement before input. See section 2.1.30.\n* Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions.\n* Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8.\n* Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5.\n* The GLOBAL directive no longer is required to precede the definition of the symbol.\n* Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5.\n* Updated UD0 encoding to match with the specification\n* Added the --limit-X command line option to set execution limits. See section 2.1.31.\n* Updated the Codeview version number to be aligned with MASM.\n* Added the --keep-all command line option to preserve output files. See section 2.1.32.\n* Added the --include command line option, an alias to -P (section 2.1.18).\n* Added the --help command line option as an alias to -h (section 3.1).\n* Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64.\n\nNew upstream version 2.13.03:\n\n* Add flags: AES, VAES, VPCLMULQDQ\n* Add VPCLMULQDQ instruction\n* elf: Add missing dwarf loc section\n* documentation updates\n  \nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-07-13T14:30:22Z","modified":"2026-02-04T04:13:20.419487Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2020:1843-1","title":"Security update for nasm","description":"\nThis update for nasm fixes the following issues:\n\nnasm was updated to version 2.14.02.\n\nThis allows building of Mozilla Firefox 78ESR and also contains lots of bugfixes, security fixes\nand improvements.\n\n* Fix crash due to multiple errors or warnings during the code generation pass if a list file is specified.\n* Create all system-defined macros defore processing command-line given preprocessing directives (-p, -d, -u, --pragma, --before).\n* If debugging is enabled, define a __DEBUG_FORMAT__ predefined macro. See section 4.11.7.\n* Fix an assert for the case in the obj format when a SEG operator refers to an EXTERN symbol declared further down in the code.\n* Fix a corner case in the floating-point code where a binary, octal or\n  hexadecimal floating-point having at least 32, 11, or 8 mantissa digits\n  could produce slightly incorrect results under very specific conditions.\n* Support -MD without a filename, for gcc compatibility. -MF can be used to set the dependencies output filename. See section 2.1.7.\n* Fix -E in combination with -MD. See section 2.1.21.\n* Fix missing errors on redefined labels; would cause convergence failure instead which is very slow and not easy to debug.\n* Duplicate definitions of the same label with the same value is now explicitly permitted (2.14 would allow it in some circumstances.)\n* Add the option --no-line to ignore %line directives in the source. See section 2.1.33 and section 4.10.1.\n* Changed -I option semantics by adding a trailing path separator unconditionally.\n* Fixed null dereference in corrupted invalid single line macros.\n* Fixed division by zero which may happen if source code is malformed.\n* Fixed out of bound access in processing of malformed segment override.\n* Fixed out of bound access in certain EQU parsing.\n* Fixed buffer underflow in float parsing.\n* Added SGX (Intel Software Guard Extensions) instructions.\n* Added +n syntax for multiple contiguous registers.\n* Fixed subsections_via_symbols for macho object format.\n* Added the --gprefix, --gpostfix, --lprefix, and --lpostfix command line options, to allow command line base symbol renaming. See section 2.1.28.\n* Allow label renaming to be specified by %pragma in addition to from the command line. See section 6.9.\n* Supported generic %pragma namespaces, output and debug. See section 6.10.\n* Added the --pragma command line option to inject a %pragma directive. See section 2.1.29.\n* Added the --before command line option to accept preprocess statement before input. See section 2.1.30.\n* Added AVX512 VBMI2 (Additional Bit Manipulation), VNNI (Vector Neural Network), BITALG (Bit Algorithm), and GFNI (Galois Field New Instruction) instructions.\n* Added the STATIC directive for local symbols that should be renamed using global-symbol rules. See section 6.8.\n* Allow a symbol to be defined as EXTERN and then later overridden as GLOBAL or COMMON. Furthermore, a symbol declared EXTERN and then defined will be treated as GLOBAL. See section 6.5.\n* The GLOBAL directive no longer is required to precede the definition of the symbol.\n* Support private_extern as macho specific extension to the GLOBAL directive. See section 7.8.5.\n* Updated UD0 encoding to match with the specification\n* Added the --limit-X command line option to set execution limits. See section 2.1.31.\n* Updated the Codeview version number to be aligned with MASM.\n* Added the --keep-all command line option to preserve output files. See section 2.1.32.\n* Added the --include command line option, an alias to -P (section 2.1.18).\n* Added the --help command line option as an alias to -h (section 3.1).\n* Added -W, -D, and -Q suffix aliases for RET instructions so the operand sizes of these instructions can be encoded without using o16, o32 or o64.\n\nNew upstream version 2.13.03:\n\n* Add flags: AES, VAES, VPCLMULQDQ\n* Add VPCLMULQDQ instruction\n* elf: Add missing dwarf loc section\n* documentation updates\n  ","status":"published","published":"2020-07-06T10:13:48Z","modified":"2026-02-04T04:10:43.688638Z","updated_at":"2026-11-02T15:53:47.634847Z"}]}}