CVE-2018-20098: Medium severity centos dos2unix vulnerability
Published Dec 12, 2018
·Updated
There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a denial of service attack.
Upstream issue:
https://github.com/Exiv2/exiv2/issues/590
References:
https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
Other sources
There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
— MITRE
Affected Software
1 affected component
exiv2 exiv2=0.27-rc3
Remediation
Patch Available
Event History
Dec 12, 2018
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Dec 18, 2018
Data Sourced
via Red Hat·10:11 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-20098?
The severity of CVE-2018-20098 is rated as medium with a CVSS score of 6.5.
2
How can I fix the heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header vulnerability (CVE-2018-20098)?
To fix the vulnerability, it is recommended to update Exiv2 to a version beyond 0.27-RC3.
3
What is the CWE associated with CVE-2018-20098?
The CWE associated with CVE-2018-20098 is CWE-125.