An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows     attackers to cause a denial of service (DOS) via a crafted input. (CVE-2020-18899)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202312-06 (Exiv2: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Exiv2. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3598-1 advisory.

    - CVE-2021-37621: Fixed denial of service due to infinite loop in Image:printIFDStructure (bsc#1189333).
    - CVE-2021-37620: Fixed out-of-bounds read in XmpTextValue:read() (bsc#1189332).
    - CVE-2021-37619: Fixed out-of-bounds read in Exiv2:Jp2Image:encodeJp2Header (bsc#1189331).
    - CVE-2021-37618: Fixed out-of-bounds read in Exiv2:Jp2Image:printStructure (bsc#1189330).
    - CVE-2021-32617: Fixed denial of service inside inefficient algorithm (quadratic complexity)     (bsc#1186192).
    - CVE-2021-31292: Fixed integer overflow in CrwMap:encode0x1810 (bsc#1188756).
    - CVE-2021-31291: Fixed heap-based buffer overflow vulnerability in jp2image.cpp may lead to a denial of     service (bsc#1188733).
    - CVE-2021-29470: Fixed out-of-bounds read in Exiv2:Jp2Image:encodeJp2Header (bsc#1185447).
    - CVE-2020-18899: Fixed uncontrolled memory allocation (bsc#1189636).
    - CVE-2020-18898: Fixed remote denial of service in printIFDStructure function (bsc#1189780).
    - CVE-2018-8977: Fixed remote denial of service in Exiv2::Internal::printCsLensFFFF function in     canonmn_int.cpp (bsc#1086798).
    - CVE-2018-8976: Fixed remote denial of service in image.cpp Exiv2::Internal::stringFormat via out-of-     bounds read (bsc#1086810).
    - CVE-2018-5772: Fixed segmentation fault caused by uncontrolled recursion inthe     Exiv2::Image::printIFDStructure (bsc#1076579).
    - CVE-2018-18915: Fixed an infinite loop in the Exiv2:Image:printIFDStructure function (bsc#1114690).
    - CVE-2018-10772: Fixed segmentation fault when the function Exiv2::tEXtToDataBuf() is finished     (bsc#1092096).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
257950	Linux Distros Unpatched Vulnerability : CVE-2020-18899	Nessus	Misc.	medium
187205	GLSA-202312-06 : Exiv2: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
166183	SUSE SLED15 / SLES15 Security Update : exiv2 (SUSE-SU-2022:3598-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-18899

medium

Tenable Plugins

medium

high

high