CVE-2018-14338: Buffer Overflow

Published Jul 17, 2018

Updated

A flaw was found in Exiv2 0.26. The samples/geotag.cpp in the example code misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow.

References: https://github.com/Exiv2/exiv2/issues/382

Other sources

samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow.

— MITRE

Affected Software

1 affected component

exiv2 exiv2=0.26

Remediation

Patch Available

https://github.com/Exiv2/exiv2/issues/382

Event History

Jul 17, 2018

CVE Published

via MITRE·12:00 PM

Data Sourced

via MITRE·12:00 PM

Description

Jul 27, 2018

Data Sourced

via Red Hat·09:40 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2018-14338?

CVE-2018-14338 has a high severity level due to the potential for buffer overflow vulnerabilities.

How do I fix CVE-2018-14338?

To fix CVE-2018-14338, you should update Exiv2 to a version beyond 0.26 where the vulnerability has been resolved.

What is the impact of CVE-2018-14338?

The impact of CVE-2018-14338 includes possible exploitation leading to arbitrary code execution via a buffer overflow.

Which versions of Exiv2 are affected by CVE-2018-14338?

CVE-2018-14338 affects Exiv2 version 0.26 specifically.

Is CVE-2018-14338 specific to any platforms?

Yes, CVE-2018-14338 specifically affects POSIX platforms excluding Apple platforms where glibc is not used.