CVE-2018-14948

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue has been found in dilawar sound through 2017-11-27. The end of openWavFile in wav-file.cc has Mismatched Memory Management Routines (operator new [] versus operator delete).

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dilawar/sound/issues/4Exploit, Third Party Advisory
https://github.com/fouzhe/security/tree/master/sound#alloc-dealloc-mismatch-in-function-openwavfileExploit, Third Party Advisory
https://github.com/dilawar/sound/issues/4Exploit, Third Party Advisory
https://github.com/fouzhe/security/tree/master/sound#alloc-dealloc-mismatch-in-function-openwavfileExploit, Third Party Advisory

Timeline

Published: Aug 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-14956.5IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which coul CVE-2018-149506.1The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.CVE-2018-149516.1The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack.CVE-2018-149526.1The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack.CVE-2018-149536.1The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack.CVE-2018-149546.1The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.CVE-2018-149556.1The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).CVE-2018-149569.8CMS ISWEB 3.5.3 is vulnerable to multiple SQL injection flaws. An attacker can inject malicious queries into the application and obtain sens CVE-2018-149579.8CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download, as demonstrated by moduli/downloadFile.php?file=oggetto_docume CVE-2018-149588.8An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and description) via index.php.CVE-2018-149598.8An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.CVE-2018-14965.4IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed