CVE-2018-20542

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

There is a heap-based buffer-overflow at generator_spgemm_csc_reader.c (function libxsmm_sparse_csc_reader) in LIBXSMM 1.10, a different vulnerability than CVE-2018-20541 (which is in a different part of the source code and is seen at a different address).

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Dec 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-205436.5There is an attempted excessive memory allocation at libxsmm_sparse_csc_reader in generator_spgemm_csc_reader.c in LIBXSMM 1.10 that will ca CVE-2018-205446.5There is floating point exception at caca/dither.c (function caca_dither_bitmap) in libcaca 0.99.beta19.CVE-2018-205458.8There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 4bpp data.CVE-2018-205468.1There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for the default bpp case.CVE-2018-205478.1There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for 24bpp data.CVE-2018-205488.8There is an illegal WRITE memory access at common-image.c (function load_image) in libcaca 0.99.beta19 for 1bpp data.CVE-2018-205498.8There is an illegal WRITE memory access at caca/file.c (function caca_file_read) in libcaca 0.99.beta19.CVE-2018-205516.5A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich CVE-2018-205527.8Tcpreplay before 4.3.1 has a heap-based buffer over-read in packet2tree in tree.c.CVE-2018-205537.8Tcpreplay before 4.3.1 has a heap-based buffer over-read in get_l2len in common/get.c.CVE-2018-205559.8The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_se CVE-2018-205568.8SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the