CVE-2020-18774 Denial of service in n/a
Attackers can cause a denial of service in applications using Exiv2 by providing a crafted TIFF file that triggers a floating point exception.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-18774?
CVE-2020-18774 is a medium-severity denial of service vulnerability in Exiv2 Exiv2, published on 23 Aug 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A float point exception in the printLong function in tags_int.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via a crafted tif file.
Weakness: CWE-369
Which versions are affected by CVE-2020-18774?
It affects 1 product.
Products include Exiv2 Exiv2.
How do I fix CVE-2020-18774?
No fix has been published for CVE-2020-18774 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-18774 being exploited?
There is no known exploitation of CVE-2020-18774 in the wild and no public exploit code.
Other vulnerabilities in Exiv2 Exiv2
Sources
Also known as DEBIAN-CVE-2020-18774, GHSA-wqqc-qm65-p7r6, UBUNTU-CVE-2020-18774.