CVE-2018-11738

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the function ntfs_make_data_run in tsk/fs/ntfs.c which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service attack.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jun 5, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-117398.1An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory regionCVE-2018-11746.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User iCVE-2018-117408.1An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory regioCVE-2018-117419.8NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in Account Information Disclosure via Home.htm?sessionIdCVE-2018-117429.8NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI.CVE-2018-117439.8The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a deniaCVE-2018-117448.1Cloudera Manager through 5.15 has Incorrect Access Control.CVE-2018-117469.8In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over iCVE-2018-117479.8Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certifiCVE-2018-117487.8Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issueCVE-2018-117499.8When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. TCVE-2018-11756.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User i
CVE-2018-11738: High severity, CVSS 8.1 | Vulnix