CVE-2018-14338 Memory corruption in n/a
A buffer overflow in Exiv2 example code allows attackers to execute arbitrary code or cause denial of service via crafted images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-14338?
CVE-2018-14338 is a high-severity memory corruption vulnerability in Exiv2 Exiv2, published on 17 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow.
Weakness: CWE-119
Which versions are affected by CVE-2018-14338?
It affects 1 product.
Products include Exiv2 Exiv2.
How do I fix CVE-2018-14338?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-14338 being exploited?
There is no known exploitation of CVE-2018-14338 in the wild and no public exploit code.
Other vulnerabilities in Exiv2 Exiv2
Sources
Also known as DEBIAN-CVE-2018-14338, GHSA-vcrp-2wmj-jrg8.