CVE-2018-20030 Denial of service in libexif
Attackers can exhaust CPU resources by sending crafted EXIF tags to applications using libexif, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20030?
CVE-2018-20030 is a high-severity denial of service vulnerability in Flexera Software LLC libexif, published on 20 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources.
Weakness: CWE-400
Which versions are affected by CVE-2018-20030?
It affects 1 product.
Products include Libexif Project Libexif.
How do I fix CVE-2018-20030?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-20030 being exploited?
There is no known exploitation of CVE-2018-20030 in the wild and no public exploit code.
Other vulnerabilities in Flexera Software LLC libexif
Sources
Also known as ALPINE-CVE-2018-20030, DEBIAN-CVE-2018-20030, GHSA-9fxq-h6qr-qghc, MGASA-2019-0095, UBUNTU-CVE-2018-20030.