[{"vendor":"libfsntfs_project","product":"libfsntfs","defaultStatus":"unknown","cpes":["cpe:2.3:a:libfsntfs_project:libfsntfs:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThanOrEqual":"20180420","versionType":"custom","status":"affected"}]}]

{"timestamp":"2024-07-23T19:38:25.274960Z","id":"CVE-2018-11728","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]

http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html

http://seclists.org/fulldisclosure/2018/Jun/17

CISA-ADP AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA-ADP CWE-125

CISA-ADP CWE-200

MITRE disputed

** DISPUTED ** The libfsntfs_reparse_point_values_read_data function in libfsntfs_reparse_point_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.

The libfsntfs_reparse_point_values_read_data function in libfsntfs_reparse_point_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub

The libfsntfs_reparse_point_values_read_data function in libfsntfs_reparse_point_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file.

** DISPUTED ** The libfsntfs_reparse_point_values_read_data function in libfsntfs_reparse_point_values.c in libfsntfs through 2018-04-20 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted ntfs file. NOTE: the vendor has disputed this as described in libyal/libfsntfs issue 8 on GitHub.

See https://github.com/libyal/libfsntfs/issues/8 for more information.

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

(AV:N/AC:M/Au:N/C:P/I:N/A:N)

(AV:L/AC:M/Au:N/C:P/I:N/A:N)

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

(AV:N/AC:M/Au:N/C:P/I:N/A:N)

CWE-125

CWE-200

OR
     *cpe:2.3:a:libfsntfs_project:libfsntfs:*:*:*:*:*:*:*:* versions up to (including) 20180420

http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html No Types Assigned

http://packetstormsecurity.com/files/148115/libfsntfs-20180420-Information-Disclosure.html Third Party Advisory, VDB Entry

http://seclists.org/fulldisclosure/2018/Jun/17 No Types Assigned

http://seclists.org/fulldisclosure/2018/Jun/17 Mailing List, Third Party Advisory

Victim must voluntarily interact with attack mechanism