Out-of-Bounds Read Vulnerability in libextractor Package
Summary
UBUNTU-CVE-2018-20430: GNU Libextractor through 1.8 has an out-of-bounds read vulnerability in the function history_extract() in plugins/ole2_extractor.c, related to EXTRACTOR_common_convert_to_utf8 in common/convert.c. Affects libextractor versions < 1:1.3-1ubuntu0.1~esm1. Fixed in 1:1.3-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libextractor is a library designed to extract metadata from various file formats. It is widely used in applications that require file analysis and metadata extraction. The library's functionality is crucial for developers who need to handle diverse file types efficiently. However, vulnerabilities in libextractor can lead to severe security risks, including data leaks and application crashes.
Vulnerability Detail
GNU Libextractor through version 1.8 has an out-of-bounds read vulnerability in the function history_extract() located in plugins/ole2_extractor.c. This vulnerability is related to the EXTRACTOR_common_convert_to_utf8 function in common/convert.c. If exploited, it could allow an attacker to read sensitive data from memory, potentially leading to information disclosure or application instability.
How To Fix
Minimum fixed version
1:1.3-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libextractorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider disabling the affected functionality in your application that relies on libextractor until a patch can be applied. This may involve modifying your code to bypass calls to the vulnerable functions.
Conclusion
The out-of-bounds read vulnerability in the libextractor package poses a serious risk to applications that utilize this library. It is essential to update to the patched versions to mitigate potential security threats. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for libextractor →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Versions of libextractor up to 1.8 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Yes, you can temporarily disable the functionality that uses libextractor until you can apply the patch.
Exploitation of this vulnerability could lead to information disclosure and application crashes, posing significant security risks.
Related vulnerabilities
Recent vulnerabilities recorded for libextractor.
