Vulnerabilities > CVE-2018-12293 - Integer Overflow or Wraparound vulnerability in multiple products

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
canonical
webkitgtk
wpewebkit
CWE-190
nessus
exploit available

Summary

The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.3 and WPE WebKit prior to version 2.20.1, is vulnerable to a heap-based buffer overflow triggered by an integer overflow, which could be abused by crafted HTML content.

Vulnerable Configurations

Part Description Count
OS
Canonical
3
Application
Webkitgtk
270
Application
Wpewebkit
9

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

Exploit-Db

descriptionWebkitGTK+ 2.20.3 - 'ImageBufferCairo::getImageData()' Buffer Overflow (PoC). CVE-2018-12293. Local exploit for Linux platform
fileexploits/linux/local/45205.txt
idEDB-ID:45205
last seen2018-08-16
modified2018-08-16
platformlinux
port
published2018-08-16
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/45205/
titleWebkitGTK+ 2.20.3 - 'ImageBufferCairo::getImageData()' Buffer Overflow (PoC)
typelocal

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201808-04.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201808-04 (WebkitGTK+: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the referenced CVE identifiers for details. Impact : A remote attacker could execute arbitrary commands or cause a denial of service condition via a maliciously crafted web content. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id112078
    published2018-08-23
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/112078
    titleGLSA-201808-04 : WebkitGTK+: Multiple vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3687-1.NASL
    descriptionA large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id110611
    published2018-06-19
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110611
    titleUbuntu 16.04 LTS / 17.10 / 18.04 LTS : webkit2gtk vulnerabilities (USN-3687-1)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/148960/webkitgtk2203-overflow.txt
idPACKETSTORM:148960
last seen2018-08-18
published2018-08-16
reporterPeregrineX
sourcehttps://packetstormsecurity.com/files/148960/WebkitGTK-2.20.3-ImageBufferCairo-getImageData-Buffer-Overflow.html
titleWebkitGTK+ 2.20.3 ImageBufferCairo::getImageData() Buffer Overflow