Summary
It was discovered that VCFtools improperly handled certain input. If a user
were tricked into opening a crafted input file, VCFtools could be made to
crash or possibly cause other unspecified impact.
(CVE-2018-11099, CVE-2018-11129, CVE-2018-11130)
It was discovered that VCFtools improperly handled memory
allocation/deallocation, resulting in a use-after-free vulnerability.
If a victim were tricked into opening a specially crafted VCF File, an
attacker could cause VCFtools to leak sensitive information or possibly
execute arbitrary code. (CVE-2019-1010127)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | vcftools | 0.1.11+dfsg-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | vcftools | 0.1.15-1ubuntu0.1~esm1 |
Vulnerabilities 4
-
Unscored —
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause information …
-
Unscored —
The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of …
-
Unscored —CVE-2018-11130 EPSS 20%
The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial o…
-
Unscored —
VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly …