CVE-2018-20097

There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

Published: Dec 12, 2018
Updated: Apr 13, 2023
CVE: CVE-2018-20097
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

CWE-119

Affected Software
References

Software	From	Fixed in
exiv2 / exiv2	0.27-rc3	0.27-rc3.x
debian / debian_linux	8.0	8.0.x
debian / debian_linux	10.0	10.0.x
fedoraproject / fedora	30	30.x
redhat / enterprise_linux_workstation	7.0	7.0.x
redhat / enterprise_linux_server	7.0	7.0.x
redhat / enterprise_linux_dekstop	7.0	7.0.x

https://access.redhat.com/errata/RHSA-2019:2101
https://github.com/Exiv2/exiv2/issues/590
https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html
https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html
https://lists.fedoraproject.org/archives/list/[email protected]/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/

Vulnerability Database

289,599

CVE-2018-20097