CVE-2018-20099: Denial of Service in exiv2
Summary
CVE-2018-20099: There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack. Affects exiv2 versions 0.1 – 0.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Exiv2 is an open-source image metadata library and toolset that allows users to read, write, and manipulate metadata in various image file formats. It is commonly used in applications that deal with image processing and management. This vulnerability affects Exiv2 version 0.27-RC3. The vulnerability resides in the jp2image.cpp file, specifically in the Exiv2::Jp2Image::encodeJp2Header function. An attacker can exploit this vulnerability by providing a crafted input, leading to an infinite loop and causing a remote denial of service attack.
Vulnerability Detail
The vulnerability in Exiv2 version 0.27-RC3 allows an attacker to trigger an infinite loop in the encodeJp2Header function of jp2image.cpp. By providing a specially crafted input, an attacker can cause the application to enter an infinite loop, resulting in a denial of service condition. This vulnerability can be exploited remotely, potentially impacting the availability of the affected application or system. The severity of this vulnerability is rated as moderate with a CVSS score of 6.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch or update to a fixed version of Exiv2 as soon as possible.
Conclusion
In conclusion, the Exiv2 library version 0.27-RC3 is vulnerable to a denial of service attack due to an infinite loop in the encodeJp2Header function. Users are advised to update to a fixed version of Exiv2, such as version 0.27-RC4, to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for exiv2 →
FAQ
Exiv2 is an open-source image metadata library and toolset used for reading, writing, and manipulating metadata in various image file formats.
This vulnerability allows an attacker to trigger an infinite loop in Exiv2, leading to a denial of service condition. This can potentially impact the availability of the affected application or system.
To fix this vulnerability, it is recommended to update to a version of Exiv2 that includes the necessary patch. The Exiv2 project has released a fix in version 0.27-RC4.
There is no known workaround for this vulnerability. It is recommended to apply the official patch or update to a fixed version of Exiv2.
The severity of this vulnerability is rated as moderate with a CVSS score of 6.5.
Related vulnerabilities
Recent vulnerabilities recorded for exiv2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
