CVE-2018-3846

Name	CVE-2018-3846
Description	In the ffgphd and ffgtkn functions in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	892458

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cfitsio (PTS)	bookworm	4.2.0-3	fixed
	trixie	4.6.2-2	fixed
	forky, sid	4.7.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cfitsio	source	(unstable)	3.430-1	low		892458

Notes

[stretch] - cfitsio <no-dsa> (Minor issue)
[jessie] - cfitsio <no-dsa> (Minor issue)
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0529
Mitigated to a crash due to hardened build flags