NULL Pointer Dereference Vulnerability in libextractor Package
Summary
UBUNTU-CVE-2018-20431: GNU Libextractor through 1.8 has a NULL Pointer Dereference vulnerability in the function process_metadata() in plugins/ole2_extractor.c. Affects libextractor versions < 1:1.3-1ubuntu0.1~esm1. Fixed in 1:1.3-1ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libextractor is a library designed to extract metadata from various file formats. It is widely used in applications that require file analysis and data extraction. The library supports multiple plugins to handle different file types, making it versatile in its functionality. However, it has been found to be vulnerable to a NULL Pointer Dereference issue, which can lead to application crashes or unexpected behavior.
Vulnerability Detail
The vulnerability identified as CVE-2018-20431 exists in GNU Libextractor versions up to 1.8, specifically within the process_metadata() function located in plugins/ole2_extractor.c. This flaw allows an attacker to exploit the library by causing a NULL pointer dereference, which can lead to denial of service (DoS) conditions. The ramifications of this vulnerability include potential crashes of applications that rely on libextractor for metadata extraction, thereby impacting their availability and reliability.
How To Fix
Minimum fixed version
1:1.3-1ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libextractorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, a temporary workaround is to disable the specific plugin that utilizes the vulnerable function, if possible. This can prevent the application from invoking the vulnerable code path until a proper update can be applied.
Conclusion
The NULL Pointer Dereference vulnerability in the libextractor package poses a significant risk to applications relying on this library for metadata extraction. It is crucial for users to update to the patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for libextractor →
FAQ
CVE-2018-20431 is a vulnerability in the libextractor package that allows for a NULL Pointer Dereference, potentially leading to application crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The primary consequence is a denial of service (DoS), where applications using the vulnerable version of libextractor may crash or behave unexpectedly.
Yes, there are patched versions available for various Ubuntu distributions. Users should update to the specified versions to mitigate the vulnerability.
The CVSS score for this vulnerability is 6.5, indicating a medium level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for libextractor.
