CVE-2018-3902
published 2018-08-23CVE-2018-3902: An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices…
critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
An exploitable buffer overflow vulnerability exists in the camera "replace" feature of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 devices with firmware version 0.20.17. The video-core process incorrectly extracts the URL field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mercurial | mercurial | >= 0 < 4.5.3-1ubuntu2.2 | 4.5.3-1ubuntu2.2 |
| mercurial | mercurial | >= 0 < 2.8.2-1ubuntu1.4+esm1 | 2.8.2-1ubuntu1.4+esm1 |
| mercurial | mercurial | >= 0 < 3.7.3-1ubuntu1.2+esm2 | 3.7.3-1ubuntu1.2+esm2 |
| samsung | smartthings_hub_sth-eth-250 | — | — |
| samsung | sth-eth-250_firmware | — | — |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
osv9.1CRITICAL