CVE-2018-18993

Description

Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior). When processing project files, the application allows input data to exceed the buffer. An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the application.

Weakness classification

• CWE-121: Stack-based Buffer Overflow
• CWE-787: Out-of-bounds Write

Primary references

• ics-cert@hq.dhs.gov — Third Party Advisory, VDB Entry
• ics-cert@hq.dhs.gov — Third Party Advisory, US Government Resource
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource