CVE-2018-20096: exiv2 - Heap-based Buffer Over-read in pngimage.cpp
Summary
CVE-2018-20096: There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. Affects exiv2 versions 0.1 – 0.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Exiv2 is an open-source image metadata library and toolset. It provides functionality for reading, writing, and manipulating metadata in various image file formats. The library is widely used in applications that deal with image processing and management. However, Exiv2 versions up to 0.27-RC3 are vulnerable to a heap-based buffer over-read in the pngimage.cpp file, specifically in the Exiv2::tEXtToDataBuf function. This vulnerability can be exploited remotely and may result in a denial of service attack.
Vulnerability Detail
The vulnerability arises due to improper handling of crafted input in the Exiv2 library. When processing a specially crafted PNG image, the tEXtToDataBuf function reads beyond the bounds of a heap buffer, leading to a buffer over-read. An attacker can exploit this flaw by providing a malicious PNG image to an application that uses the Exiv2 library, causing the application to crash or become unresponsive. The impact of this vulnerability is limited to denial of service, as it does not allow for arbitrary code execution or privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted PNG images with applications that utilize the vulnerable Exiv2 library. By refraining from opening or manipulating suspicious PNG files, the risk of encountering this vulnerability can be minimized.
Conclusion
The Exiv2 library versions up to 0.27-RC3 are vulnerable to a heap-based buffer over-read in the pngimage.cpp file. This vulnerability can be exploited remotely, leading to a denial of service attack. To mitigate the risk, users should update their Exiv2 installations to a patched version and avoid processing untrusted PNG images. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for exiv2 →
FAQ
The vulnerability can lead to a denial of service attack, causing affected applications to crash or become unresponsive. However, it does not allow for arbitrary code execution or privilege escalation.
Versions up to 0.27-RC3 of the Exiv2 library are vulnerable to this issue.
While the vulnerability has been identified, there is no known public exploit available at this time.
Updating to a patched version of the Exiv2 library is the recommended mitigation. Additionally, users can avoid processing untrusted PNG images as a temporary workaround.
For more information, you can refer to the official Exiv2 advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/exiv2/PYSEC-2018-117.yaml
Related vulnerabilities
Recent vulnerabilities recorded for exiv2.
