CVE-2018-16140: canonical ubuntu_linux Out-of-bounds Write
CVSS: 7.8v3.0HighModified
AliasesMGASA-2019-0064SUSE-SU-2019:1291-1UBUNTU-CVE-2018-16140USN-3760-1DEBIAN-CVE-2018-16140openSUSE-SU-2019:1455-1
Published 30-08-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-16140 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in canonical ubuntu_linux. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.6% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.0 (NVD)EPSS score
1.43%
0%100%
Low · +0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 30-08-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer via a crafted .fig file.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.43%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
+0.05 pp
From 1.38% on 18-09-2026
18-09-202618-10-2026
EPSS score1.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Opensuse2 products
- transfig&distro=openSUSE Leap 15.0< 3.2.6a-lp151.4.3.1
- transfig&distro=openSUSE Leap 15.1< 3.2.6a-lp151.4.3.1
Ubuntu2 products
- fig2devAll versions (No fix recorded)
- transfig< 1:3.2.5.e-1ubuntu1.1 | < 1:3.2.5.e-5ubuntu0.1
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04
Debian1 product
- fig2dev< 1:3.2.7a-3
Fig2dev_project1 product
- fig2dev3.2.7a
Mageia1 product
- transfig< 3.2.5d-9.2.mga6
Suse1 product
- transfig&distro=SUSE Linux Enterprise Workstation Extension 15< 3.2.6a-4.3.51
7 vendors · 9 products
References
13 linksShow all 13 references
- lists.opensuse.org/archives/…Advisory