Summary
It was discovered that EditorConfig improperly managed memory when handling
certain inputs, leading to overflows. An attacker could possibly use these
issues to cause a denial of service, or execute arbitrary code.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | editorconfig-core | 0.12.1-1.1+deb11u1build0.20.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | editorconfig-core | 0.12.0-2ubuntu0.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | editorconfig-core | 0.12.1-1.1ubuntu0.18.04.1~esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | editorconfig-core | 0.12.5-2ubuntu0.1~esm2 |
Vulnerabilities 2
-
High 7.8
Stack Buffer Overflow in editorconfig-core-c
A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by boun…
-
Medium 4.8
Several stack buffer overflows and pointer overflows in editorconfig-core-c
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backs…