Out-of-Bounds Read Vulnerability in GNU Libextractor: CVE-2018-16430
Summary
UBUNTU-CVE-2018-16430: GNU Libextractor through 1.7 has an out-of-bounds read vulnerability in EXTRACTOR_zip_extract_method() in zip_extractor.c. Affects libextractor versions < 1:1.3-1ubuntu0.1~esm1. Fixed in 1:1.3-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Libextractor is a library that extracts metadata from various file formats. It is widely used in applications that require file analysis and metadata extraction. The library's functionality allows it to handle multiple file types, making it a versatile tool for developers. However, a critical vulnerability has been identified in versions up to 1.7, which could lead to severe security risks if not addressed.
Vulnerability Detail
The vulnerability, identified as CVE-2018-16430, is an out-of-bounds read issue in the EXTRACTOR_zip_extract_method() function located in zip_extractor.c. This flaw allows attackers to exploit the library by causing it to read beyond the allocated memory buffer, potentially leading to information disclosure or application crashes. The vulnerability has a CVSS score of 8.8, indicating a high severity level, and could be exploited remotely without authentication.
How To Fix
Minimum fixed version
1:1.3-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libextractorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionality of the library until the package is updated. This may involve modifying the application code to bypass calls to the EXTRACTOR_zip_extract_method() function.
Conclusion
The out-of-bounds read vulnerability in GNU Libextractor (CVE-2018-16430) poses significant risks to applications utilizing this library. It is crucial for users to update to the patched version to mitigate potential security threats. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libextractor →
FAQ
CVE-2018-16430 is a vulnerability in GNU Libextractor that allows for out-of-bounds reading, potentially leading to information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes or unauthorized access to sensitive information.
Yes, a patched version of libextractor is available. Users should update to version 1:1.3-1ubuntu0.1~esm1 or later.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for libextractor.
