PatchTheCVEmd4c project vulnerabilities
Recent CVEs affecting md4c project products. 8 tracked.
md4c project has 8 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 1. Most recent: 2021-04-29. Highest priority: CVE-2018-11536 (score 64/100).
- CVE-2021-30027 MEDIUM 5.5 DOWNGRADE md_analyze_line in md4c.c in md4c 0.4.7 allows attackers to trigger use of uninitialized memory, and cause a d
- CVE-2020-26148 HIGH 7.5 DOWNGRADE md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause
- CVE-2018-12112 HIGH 7.8 DOWNGRADE md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation
- CVE-2018-12102 MEDIUM 5.5 DOWNGRADE md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to ctx->current_b
- CVE-2018-11547 CRITICAL 9.8 DOWNGRADE md_is_link_reference_definition_helper in md4c 0.2.5 has a heap-based buffer over-read because md_is_link_labe
- CVE-2018-11546 CRITICAL 9.8 DOWNGRADE md4c 0.2.5 has a heap-based buffer over-read because md_is_named_entity_contents has an off-by-one error.
- CVE-2018-11545 CRITICAL 9.8 DOWNGRADE md4c 0.2.5 has a heap-based buffer overflow in md_merge_lines because md_is_link_label mishandles the case of
- CVE-2018-11536 CRITICAL 9.8 UPGRADE md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits.
FAQ
How do I fix md4c project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is md4c project being exploited right now?
None of the tracked md4c project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which md4c project CVE should I patch first?
CVE-2018-11536 currently ranks highest (64/100): md4c before 0.2.5 has a heap-based buffer overflow because md_split_simple_pairing_mark mishandles splits..