CVE-2018-20721
Fixed in a distro release EPSS 2%
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
Products: uriparser_project uriparser, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | uriparser | 0.9.1-1 |
| Debian 13 | uriparser | 0.9.1-1 |
| Debian 14 | uriparser | 0.9.1-1 |
| Debian 8 | uriparser | 0.8.0.1-2+deb8u2 |
| Debian 9 | uriparser | 0.8.4-1+deb9u2 |
| SUSE Package Hub 15 | uriparser | 0.8.5-bp150.2.3.1 |
| Ubuntu 18.04 LTS | uriparser | 0.8.4-1+deb9u2build0.18.04.1 |
| Ubuntu Pro 14.04 LTS | uriparser | 0.7.5-1ubuntu2+esm2 |
| Ubuntu Pro 16.04 LTS | uriparser | 0.8.4-1ubuntu0.16.04.1~esm2 |
| openSUSE Leap 15.0 | uriparser | 0.8.5-lp150.2.3.1 |
| openSUSE Tumbleweed | uriparser | 0.9.5-1.2 |