PatchTheCVEmd4c vulnerabilities and fixes
Recent CVEs affecting md4c, with upgrade or downgrade steps. 8 tracked.
md4c has 8 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 1. Most recent: 2021-04-29. Highest priority: CVE-2018-11536 (score 64/100).
- CVE-2021-30027 MEDIUM 5.5 DOWNGRADE md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a d
- CVE-2020-26148 HIGH 7.5 DOWNGRADE md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause
- CVE-2018-12112 HIGH 7.8 DOWNGRADE md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation
- CVE-2018-12102 MEDIUM 5.5 DOWNGRADE md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to ctx->current_b
- CVE-2018-11547 CRITICAL 9.8 DOWNGRADE md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_labe
- CVE-2018-11546 CRITICAL 9.8 DOWNGRADE md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.
- CVE-2018-11545 CRITICAL 9.8 DOWNGRADE md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of
- CVE-2018-11536 CRITICAL 9.8 UPGRADE md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.
FAQ
How do I fix md4c vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is md4c being exploited right now?
None of the tracked md4c CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which md4c CVE should I patch first?
CVE-2018-11536 currently ranks highest (64/100): md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits..