Is CVE-2018-16982 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-16982 being exploited in the wild.

How severe is CVE-2018-16982?

Low severity, with a CVSS score of 3, published 14 May 2022.

Which products and versions are affected?

opencc (npm) SEMVER:introduced=0,fixed=1.1.2.

Is there a fix for CVE-2018-16982?

Yes. opencc (npm): upgrade to 1.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-16982 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2018-16982?

Check whether you run opencc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-16982: Open Chinese Convert out-of-bounds read denial of service

CVE-2018-16982 · Severity: low · CVSS 3 · Published 2022-05-14

Open Chinese Convert (OpenCC) is a library used to convert between Traditional and Simplified Chinese characters. A flaw in how it reads dictionary files (.ocd format) allows attackers to craft a malicious file that causes the application to crash, disrupting any service that depends on this library for language conversion functionality.

Technologies: opencc (npm). Vendors: npm.

Quick answers

Is CVE-2018-16982 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-16982 being exploited in the wild.
How severe is CVE-2018-16982?: Low severity, with a CVSS score of 3, published 14 May 2022.
Which products and versions are affected?: opencc (npm) SEMVER:introduced=0,fixed=1.1.2.
Is there a fix for CVE-2018-16982?: Yes. opencc (npm): upgrade to 1.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-16982 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2018-16982?: Check whether you run opencc (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

opencc (npm): upgrade to 1.1.2 or later
```
npm install opencc@1.1.2
```

Technical details

The vulnerability is an out-of-bounds read in BinaryDict::NewFromFile (BinaryDict.cpp) where keyOffset and valueOffset values parsed from a crafted .ocd file can be set to arbitrary values. This causes pointer dereferences to access invalid memory, resulting in a segmentation fault and denial of service. The attack requires only that an application processes a user-supplied or attacker-controlled .ocd dictionary file; no authentication or network access is required. The vulnerability affects OpenCC versions prior to 1.1.2, with patches available in the referenced pull requests.

Affected products

OpenCC OpenCC prior to 1.1.2

Identifiers

CVE-2018-16982
GHSA-9qh2-6fxg-9m4g

Timeline

2018-09-13: disclosed
2018: patched: Fixes available in PR #309 and #560

References

https://github.com/BYVoid/OpenCC/issues/303

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.