VYPR
← All advisories
Critical severity9.8OSV Advisory· Published Aug 20, 2018· Updated Jun 17, 2026

CVE-2018-1000221

CVE-2018-1000221

Description

pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.

Affected products

2
  • Pkgconf/PkgconfOSV2 versions
    pkgconf-0.1, pkgconf-0.1.1, pkgconf-0.2, …+ 1 more
    • (no CPE)range: pkgconf-0.1, pkgconf-0.1.1, pkgconf-0.2, …
    • (no CPE)range: 1.5.0 to 1.5.2

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.