CVE-2018-20096: Medium severity centos dos2unix vulnerability
There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a denial of service attack.
Upstream issue:
https://github.com/Exiv2/exiv2/issues/590
References:
https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
Other sources
There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-20096?
CVE-2018-20096 has been classified as a moderate severity vulnerability due to its potential to cause remote denial of service.
How do I fix CVE-2018-20096?
To fix CVE-2018-20096, upgrade Exiv2 to the latest stable version that addresses this vulnerability.
What types of attacks can CVE-2018-20096 be exploited for?
CVE-2018-20096 can be exploited to perform remote denial of service attacks against affected Exiv2 installations.
What software versions are affected by CVE-2018-20096?
CVE-2018-20096 specifically affects Exiv2 version 0.27-RC3.
Is there a public proof of concept for CVE-2018-20096?
Yes, there are public proof of concept examples available that demonstrate the exploitation of CVE-2018-20096.