CVE-2018-15159

Name of the Vulnerable Software and Affected Versions libesedb versions prior to 2018-04-01

Description The issue allows remote attackers to cause a heap-based buffer over-read via a crafted esedb file. This is due to a problem in the libesedb page read tags function in libesedb page.c. The vendor has disputed this issue as described in the GitHub issue comments.

Recommendations For versions prior to 2018-04-01, consider applying changes to the libesedb page read tags function to prevent the heap-based buffer over-read. At the moment, there is no information about a newer version that contains a fix for this vulnerability.