CVE-2018-20098

MEDIUM6.5EPSS 1.0%

Published: 12/12/2018Modified: 10/9/2025

Description

There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

Affected packages (1)

PyPI/exiv2from 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References (4)

ADVISORYhttps://access.redhat.com/errata/RHSA-2019:2101
REPORThttps://github.com/Exiv2/exiv2/issues/590
WEBhttps://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/