CVE-2018-11731

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The libfsntfs_mft_entry_read_attributes function in libfsntfs_mft_entry.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125 CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jun/17Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jun/17Mailing List, Third Party Advisory

Timeline

Published: Jun 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-117346.1In e107 v2.1.7, output without filtering results in XSS.CVE-2018-117356.1index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter.CVE-2018-117369.8An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by CVE-2018-117378.1An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region CVE-2018-117388.1An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region CVE-2018-117398.1An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region CVE-2018-11746.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User i CVE-2018-117408.1An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory regio CVE-2018-117419.8NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionId CVE-2018-117429.8NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.CVE-2018-117439.8The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denia CVE-2018-117448.1Cloudera Manager through 5.15 has Incorrect Access Control.