CVE-2018-20098: Heap-based Buffer Over-read in exiv2
Summary
CVE-2018-20098: There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. Affects exiv2 versions 0.1 – 0.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Exiv2 is an open-source image metadata library and toolset. It provides functionality to read, write, and manipulate metadata in various image formats. The vulnerability in question, identified as CVE-2018-20098, affects Exiv2 version 0.27-RC3. This vulnerability specifically resides in the 'jp2image.cpp' file, within the 'Exiv2::Jp2Image::encodeJp2Header' function. An attacker can exploit this vulnerability by providing a crafted input, leading to a remote denial of service attack.
Vulnerability Detail
The vulnerability arises due to a heap-based buffer over-read in the 'encodeJp2Header' function of 'jp2image.cpp'. When a specially crafted input is processed, it triggers the over-read, causing the application to crash or become unresponsive. This can be exploited remotely, allowing an attacker to disrupt the availability of the affected system. The severity of this vulnerability is rated as 'High' with a CVSS score of 6.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can consider implementing network-level mitigations such as firewalls or intrusion prevention systems to restrict access to the affected system. However, this is not a definitive solution and should be used as a temporary measure until the package can be updated to a secure version.
Conclusion
In conclusion, the vulnerability CVE-2018-20098 in Exiv2 version 0.27-RC3 can be exploited remotely to cause a denial of service attack. Users are advised to update their Exiv2 package to a secure version beyond 0.27-RC3. Regularly updating software dependencies is crucial to ensure the application remains protected against known vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for exiv2 →
FAQ
Exiv2 is an open-source image metadata library and toolset that allows users to read, write, and manipulate metadata in various image formats.
This vulnerability can be exploited remotely to cause a denial of service attack, leading to the unavailability of the affected system.
The CVSS score of this vulnerability is 6.5, indicating a high severity level.
To fix this vulnerability, it is recommended to update the Exiv2 package to a version that includes the necessary patches. Upgrading to a version beyond 0.27-RC3 is advised.
As a temporary workaround, users can implement network-level mitigations such as firewalls or intrusion prevention systems to restrict access to the affected system.
Related vulnerabilities
Recent vulnerabilities recorded for exiv2.
