CVE-2018-3847

Name	CVE-2018-3847
Description	Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	892458

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cfitsio (PTS)	bullseye	3.490-3	fixed
	bookworm	4.2.0-3	fixed
	forky, sid, trixie	4.6.2-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cfitsio	source	(unstable)	3.430-1	low		892458

Notes

[stretch] - cfitsio <no-dsa> (Minor issue)
[jessie] - cfitsio <no-dsa> (Minor issue)
https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0530