Vulnerability Description
PMS 0.42 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious values in the configuration file. Attackers can craft configuration files with oversized input that overflows the stack buffer and execute shell commands via return-oriented programming gadgets.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kimtore | Practical Music Search | <= 0.42 |
Related Weaknesses (CWE)
References
- https://pms.sourceforge.netProduct
- https://www.exploit-db.com/exploits/44426ExploitVDB Entry
- https://www.vulncheck.com/advisories/pms-stack-based-buffer-overflow-via-configuThird Party Advisory
FAQ
What is CVE-2018-25224?
CVE-2018-25224 is a vulnerability with a CVSS score of 8.4 (HIGH). PMS 0.42 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious values in the configuration file. Attackers c...
How severe is CVE-2018-25224?
CVE-2018-25224 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-25224?
Check the references section above for vendor advisories and patch information. Affected products include: Kimtore Practical Music Search.