CVE-2018-15503

Published: Aug 18, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploit this vulnerability and cause a SEGV.

Affected (1)

Products: Swoole: Swoole

Swoole

1 product

Swoole

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Swoole Swoole	Version 4.0.4

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (6)

https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76

Source: cve@mitre.org

PatchVendor Advisory

https://github.com/swoole/swoole-src/issues/1882

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://x-c3ll.github.io/posts/swoole-deserialization-cve-2018-15503/

Source: cve@mitre.org

Technical DescriptionThird Party Advisory

https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://github.com/swoole/swoole-src/issues/1882

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://x-c3ll.github.io/posts/swoole-deserialization-cve-2018-15503/

Source: af854a3a-2127-422b-91ae-364da2661108

Technical DescriptionThird Party Advisory

Timeline

No history available yet.