CVE-2018-20097

NameCVE-2018-20097
DescriptionThere is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1691-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
exiv2 (PTS)jessie0.24-4.1vulnerable
jessie (security)0.24-4.1+deb8u4fixed
stretch (security), stretch0.25-3.1+deb9u1vulnerable
bullseye, sid, buster0.25-4vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
exiv2source(unstable)(unfixed)low
exiv2sourcejessie0.24-4.1+deb8u3mediumDLA-1691-1

Notes

[buster] - exiv2 <no-dsa> (Minor issue)
[stretch] - exiv2 <no-dsa> (Minor issue)
https://github.com/Exiv2/exiv2/issues/590
https://github.com/Exiv2/exiv2/commit/203ab0db28c9666b16069d4056ac5f66f753a51d

Search for package or bug name: Reporting problems