Search for vulnerabilities
Vulnerability details: VCID-aptq-9f59-aaad
Vulnerability ID VCID-aptq-9f59-aaad
Aliases CVE-2018-15120
Summary libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.
Status Published
Exploitability 2.0
Weighted Severity 6.2
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-617 Reachable Assertion
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-15120.html
cvssv3 4.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-15120.json
epss 0.01540 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.01540 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.01540 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.01540 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.01740 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.01740 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.01740 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.01740 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.01740 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.02448 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.02448 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.02448 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.02448 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.02448 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.02448 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.0665 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.0665 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.0665 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.0665 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.0665 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.0665 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.06769 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
epss 0.12182 https://api.first.org/data/v1/epss?cve=CVE-2018-15120
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1613550
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120
cvssv3 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2018-15120
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2018-15120
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2018-15120
generic_textual Medium https://ubuntu.com/security/notices/USN-3750-1
Reference id Reference type URL
http://52.117.224.77/xfce4-pdos.webm
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-15120.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-15120.json
https://api.first.org/data/v1/epss?cve=CVE-2018-15120
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15120
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/GNOME/pango/blob/1.42.4/NEWS
https://github.com/GNOME/pango/commit/71aaeaf020340412b8d012fe23a556c0420eda5f
https://i.redd.it/v7p4n2ptu0s11.jpg
https://mail.gnome.org/archives/distributor-list/2018-August/msg00001.html
https://security.gentoo.org/glsa/201811-07
https://ubuntu.com/security/notices/USN-3750-1
https://usn.ubuntu.com/3750-1/
https://www.exploit-db.com/exploits/45263
https://www.exploit-db.com/exploits/45263/
https://www.ign.com/articles/2018/10/16/ps4s-are-reportedly-being-bricked-and-sony-is-working-on-a-fix
https://www.reddit.com/r/PS4/comments/9o5efg/message_bricking_console_megathread/
1613550 https://bugzilla.redhat.com/show_bug.cgi?id=1613550
cpe:2.3:a:gnome:pango:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnome:pango:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
CVE-2018-15120 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/dos/45263.sh
CVE-2018-15120 https://nvd.nist.gov/vuln/detail/CVE-2018-15120
Data source Exploit-DB
Date added Aug. 27, 2018
Description Libpango 1.40.8 - Denial of Service (PoC)
Ransomware campaign use Unknown
Source publication date Aug. 27, 2018
Exploit type dos
Platform multiple
Source update date March 15, 2021
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-15120.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2018-15120
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-15120
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-15120
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.86787
EPSS Score 0.01540
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.