Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-20712

CVE-2018-20712: A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU...

6.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-20712
GHSA ID
GHSA-cgr8-f44r-j4r5
EPSS Score
0.76758%
CWE
CWE-125
Published
5/13/2022
Updated
2/2/2023
KEV Status
No
Technology
-

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerable function d_expression_1 in cp-demangle.c was identified directly from the vulnerability description and confirmed by multiple security advisories (NVD, GitHub). Attempts to fetch detailed commit information from the provided bugzilla URLs failed due to anti-bot measures. However, the available information is highly consistent and explicitly names the function and the nature of the vulnerability (heap-based buffer over-read). Therefore, the identification is made with high confidence based on these textual descriptions rather than direct patch analysis, which was not possible in this instance. The function processes input in a way that can lead to reading beyond allocated buffer boundaries if the input is crafted maliciously, causing a denial of service (segmentation fault).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* ***p-**s** *u***r ov*r-r*** *xists in t** *un*tion *_*xpr*ssion_* in *p-**m*n*l*.* in *NU li*i**rty, *s *istri*ut** in *NU *inutils *.**.*. * *r**t** input **n **us* s**m*nt*tion **ults, l***in* to **ni*l-o*-s*rvi**, *s **monstr*t** *y *++*ilt.

Reasoning

T** vuln*r**l* *un*tion *_*xpr*ssion_* in *p-**m*n*l*.* w*s i**nti*i** *ir**tly *rom t** vuln*r**ility **s*ription *n* *on*irm** *y multipl* s**urity **visori*s (NV*, *it*u*). *tt*mpts to **t** **t*il** *ommit in*orm*tion *rom t** provi*** *u*zill* U