CVE-2018-0496

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-12 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system.

Affected products

Debian Linux: 8.0
Dinknetwork Dfarc: before 3.14 — fixed in 3.14
Dinknetwork Dfarc2: before 3.14 — fixed in 3.14

How to fix

Upgrade to a fixed version: Dinknetwork Dfarc 3.14; Dinknetwork Dfarc2 3.14. Check the vendor advisory for mitigations.

References

https://git.savannah.gnu.org/cgit/freedink/dfarc.git/commit/?id=40cc957f52e772f45125126439ba9333cf2d2998
https://lists.debian.org/debian-lts-announce/2019/02/msg00033.html
https://savannah.gnu.org/forum/forum.php?forum_id=9169
https://git.savannah.gnu.org/cgit/freedink/dfarc.git/commit/?id=40cc957f52e772f45125126439ba9333cf2d2998
https://lists.debian.org/debian-lts-announce/2019/02/msg00033.html
https://savannah.gnu.org/forum/forum.php?forum_id=9169

Get alerted when CVE-2018-0496 or the next vulnerability affects your stack