CVE-2018-20097: Buffer Overflow
There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimageint.cpp in Exiv2 0.27-RC3. A crafted input will lead to a denial of service attack.
Upstream issue:
https://github.com/Exiv2/exiv2/issues/590
References:
https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
Other sources
There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimageint.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-20097?
CVE-2018-20097 is classified as a denial of service vulnerability due to a segmentation fault in Exiv2 0.27-RC3.
How do I fix CVE-2018-20097?
To mitigate CVE-2018-20097, upgrade to a patched version of Exiv2 that addresses the segmentation fault.
What versions of Exiv2 are affected by CVE-2018-20097?
CVE-2018-20097 specifically affects Exiv2 version 0.27-RC3.
What systems are vulnerable to CVE-2018-20097?
CVE-2018-20097 impacts multiple systems including Debian 8.0, Debian 10.0, Fedora 30, and Red Hat Enterprise Linux 7.0.
What type of attack can exploit CVE-2018-20097?
CVE-2018-20097 can be exploited to execute a remote denial of service attack through crafted input.