Critical
barcode — security advisory
GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system.
- Products
- barcode
- Affected versions
- 0.98+debian-9.1, 0.98+debian-9.1build1, 0.99-3, 0.99-4, 0.99-5, 0.99-6, 0.99-7, 0.99-9, 0.99-9build1
- Fixed versions
- Not specified
- CVEs
- CVE-2018-25154
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:29 UTC · Revision 1
Source evidence
GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system.
osv:UBUNTU-CVE-2018-25154
barcode
Fixed versions: Not specified
barcode
Fixed versions: Not specified
barcode
Fixed versions: Not specified
barcode
Fixed versions: Not specified
barcode
Fixed versions: Not specified
barcode
Fixed versions: Not specified
barcode
Fixed versions: Not specified
barcode
Fixed versions: Not specified
Complete source record
{
"id": "af8c82046d8bbdebc2bae8c3dc9598fe44ac548a1a83e1cb3fc550e18b48d078",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2018-25154",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2018-25154",
"summary": "GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system.",
"evidence": "osv:UBUNTU-CVE-2018-25154",
"products": [
{
"name": {
"value": "barcode",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.98+debian-9.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "barcode",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.98+debian-9.1",
"evidence": "/affected/1/versions"
},
{
"value": "0.98+debian-9.1build1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "barcode",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.99-3",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "barcode",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.99-4",
"evidence": "/affected/3/versions"
},
{
"value": "0.99-5",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "barcode",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.99-6",
"evidence": "/affected/4/versions"
},
{
"value": "0.99-7",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "barcode",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.99-9",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "barcode",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.99-9build1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "barcode",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.99-9",
"evidence": "/affected/7/versions"
},
{
"value": "0.99-9build1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2018-25154",
"aliases": [
"UBUNTU-CVE-2018-25154"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "barcode",
"purl": "pkg:deb/ubuntu/barcode?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.98+debian-9.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25154.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "barcode",
"binary_version": "0.98+debian-9.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "barcode",
"purl": "pkg:deb/ubuntu/barcode?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.98+debian-9.1",
"0.98+debian-9.1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25154.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "barcode",
"binary_version": "0.98+debian-9.1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "barcode",
"purl": "pkg:deb/ubuntu/barcode?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.99-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25154.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "barcode",
"binary_version": "0.99-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "barcode",
"purl": "pkg:deb/ubuntu/barcode?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.99-4",
"0.99-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25154.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "barcode",
"binary_version": "0.99-5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "barcode",
"purl": "pkg:deb/ubuntu/barcode?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.99-6",
"0.99-7"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25154.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "barcode",
"binary_version": "0.99-7"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "barcode",
"purl": "pkg:deb/ubuntu/barcode?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"0.99-9"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25154.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "barcode",
"binary_version": "0.99-9"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "barcode",
"purl": "pkg:deb/ubuntu/barcode?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.99-9build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25154.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "barcode",
"binary_version": "0.99-9build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "barcode",
"purl": "pkg:deb/ubuntu/barcode?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.99-9",
"0.99-9build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-25154.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "barcode",
"binary_version": "0.99-9build1"
}
]
}
}
],
"modified": "2026-10-17T12:55:25.626921332Z",
"provider": "osv",
"upstream": [
"CVE-2018-25154"
],
"references": [
"https://ubuntu.com/security/CVE-2018-25154",
"https://www.cve.org/CVERecord?id=CVE-2018-25154",
"https://lists.gnu.org/archive/html/bug-barcode/2018-05/msg00002.html",
"https://www.exploit-db.com/exploits/44797",
"https://directory.fsf.org/wiki/Barcode",
"https://www.gnu.org/software/barcode/"
]
},
"related_cves": [
{
"value": "CVE-2018-25154",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 353746,
"published_at": "2025-12-24T20:15:00+00:00"
}