Denial of Service Vulnerability in Exiv2 Image Metadata Library
CVE-2020-18898

6.5MEDIUM

Key Information:

Vendor

Exiv2

Status
Exiv2
Vendor
CVE Published:
19 August 2021

What is CVE-2020-18898?

A stack exhaustion vulnerability exists in the printIFDStructure function of Exiv2 version 0.27, enabling remote attackers to exploit this flaw. By submitting a specially crafted file, an attacker can trigger a denial of service condition, ultimately disrupting the functionality of applications that rely on the Exiv2 library for handling image metadata.

References

https://github.com/Exiv2/exiv2/issues/741
x_refsource_MISC
https://cwe.mitre.org/data/definitions/674.html
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.