CVE-2018-20030: High severity Libexif Project Libexif vulnerability
An error when processing the EXIFIFDINTEROPERABILITY and EXIFIFDEXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libexifto a version that resolves this vulnerability.Fixed in 0.6.22-3Fixed in 0.6.24-1Fixed in 0.6.25-1 - Upgrade
Upgrade
alpine/libexifto a version that resolves this vulnerability.Fixed in 0.6.22-r0
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID for this issue is CVE-2018-20030.
What is the severity of CVE-2018-20030?
The severity of CVE-2018-20030 is high with a CVSS score of 7.5.
How can the vulnerability CVE-2018-20030 be exploited?
The vulnerability CVE-2018-20030 can be exploited to exhaust available CPU resources.
Which software versions are affected by CVE-2018-20030?
The affected software versions include libexif version 0.6.21-4ubuntu0.2, 0.6.21-1ubuntu1+, 0.6.21-2ubuntu0.2, 0.6.21-5.1+deb10u5, 0.6.22-3, and 0.6.24-1.
What is the remedy for CVE-2018-20030?
The remedy for CVE-2018-20030 is to update libexif to version 0.6.21-4ubuntu0.2, 0.6.21-1ubuntu1+, 0.6.21-2ubuntu0.2, 0.6.21-5.1+deb10u5, 0.6.22-3, or 0.6.24-1.