CVE-2018-7998: Race Condition
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vipsregiongenerate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vipsto a version that resolves this vulnerability.Fixed in 8.7.4-1+deb10u1Fixed in 8.10.5-2Fixed in 8.14.1-3+deb12u1Fixed in 8.15.1-1Fixed in 8.15.2-1 - Upgrade
Upgrade
ubuntu/vipsto a version that resolves this vulnerability.Fixed in 8.4.5-1ubuntu0.1~ - Upgrade
Upgrade
ubuntu/vipsto a version that resolves this vulnerability.Fixed in 8.4.5-2 - Upgrade
Upgrade
ubuntu/vipsto a version that resolves this vulnerability.Fixed in 8.2.2-1ubuntu0.1~
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-7998.
What is the severity of CVE-2018-7998?
The severity of CVE-2018-7998 is high.
How can remote attackers exploit CVE-2018-7998?
Remote attackers can exploit CVE-2018-7998 by sending a crafted image file, which may cause a denial of service or possibly have other unspecified impact.
What is the affected software for CVE-2018-7998?
The affected software for CVE-2018-7998 is Libvips version up to 8.6.3 and Debian Linux version 7.0.
How can I fix CVE-2018-7998?
To fix CVE-2018-7998, upgrade to Libvips version 8.6.3 or later, or apply the appropriate updates for Debian Linux.