CVE-2018-9145: Input Validation
A flaw was found in Exiv2 0.26, there is a reachable assertion abort in the function Exiv2::DataBuf::DataBuf at include/exiv2/types.hpp.
References: https://bugzilla.novell.com/showbug.cgi?id=1087879
Other sources
In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a SIGABRT during an attempt at memory allocation. NOTE: some third parties have been unable to reproduce the SIGABRT when using the 4-DataBuf-abort-1 PoC file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-9145?
CVE-2018-9145 is classified as a medium severity vulnerability due to its potential for denial of service through an assertion abort.
How do I fix CVE-2018-9145?
To fix CVE-2018-9145, upgrade Exiv2 to version 0.27 or later where the issue is patched.
What components are affected by CVE-2018-9145?
CVE-2018-9145 affects Exiv2 version 0.26 specifically.
Is CVE-2018-9145 exploitable remotely?
CVE-2018-9145 is not known to be exploitable remotely, as it requires specific conditions to trigger an assertion abort.
Who is the vendor for CVE-2018-9145?
The vendor for CVE-2018-9145 is Exiv2, which is responsible for the maintenance and updates of the software.