CVE-2020-18898
Summary
| CVE | CVE-2020-18898 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-08-19 22:15:00 UTC |
| Updated | 2022-10-26 19:09:00 UTC |
| Description | A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file. |
Risk And Classification
Problem Types: CWE-674
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CWE - CWE-674: Uncontrolled Recursion (4.2) | MISC | cwe.mitre.org | |
| [bug report] Stack Exhaustion Caused By Exiv2::Image::printIFDStructure function in image.cpp, making Recursive Calls to Itself · Issue #741 · Exiv2/exiv2 · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159814 Oracle Enterprise Linux Security Update for exiv2 (ELSA-2022-1842)
- 159821 Oracle Enterprise Linux Security Update for compat-exiv2-026 (ELSA-2022-1797)
- 240274 Red Hat Update for exiv2 security (RHSA-2022:1842)
- 240296 Red Hat Update for compat-exiv2-026 (RHSA-2022:1797)
- 671347 EulerOS Security Update for exiv2 (EulerOS-SA-2022-1266)
- 671666 EulerOS Security Update for exiv2 (EulerOS-SA-2022-1715)
- 752681 SUSE Enterprise Linux Security Update for exiv2 (SUSE-SU-2022:3598-1)
- 940514 AlmaLinux Security Update for exiv2 (ALSA-2022:1842)
- 940548 AlmaLinux Security Update for compat-exiv2-026 (ALSA-2022:1797)
- 960376 Rocky Linux Security Update for exiv2 (RLSA-2022:1842)
- 960417 Rocky Linux Security Update for compat-exiv2-026 (RLSA-2022:1797)