Description
A vulnerability was identified in FascinatedBox lily up to 2.3. This issue affects the function patch_line_end of the file src/lily_build_error.c of the component Error Reporting. The manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FascinatedBox | lily | 2.0, 2.1, 2.2, 2.3 | — |
References
- VDB-348276 | FascinatedBox lily Error Reporting lily_build_error.c patch_line_end out-of-bounds vdb-entry technical-description
- VDB-348276 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #761326 | FascinatedBox lily main-branch Heap-based Buffer Overflow third-party-advisory
- https://github.com/FascinatedBox/lily/issues/382 issue-tracking
- https://github.com/oneafter/0122/blob/main/i382/repro.lily exploit
- https://github.com/FascinatedBox/lily/ product