CVE-2018-20030 — libexif - security update

Description

An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources.

How to fix CVE-2018-20030

To remediate CVE-2018-20030, upgrade the affected package to a fixed version below.

Alpine/libexif—upgrade to 0.6.22-r0 or later
Debian/libexif—upgrade to 0.6.21-5.1 or later
—upgrade to 0.6.21-2+deb8u3 or later

Is CVE-2018-20030 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

from 0, < 0.6.22-r0
from 0, < 0.6.21-5.1
from 0, < 0.6.21-2+deb8u3

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (2)

ADVISORYsecurity.alpinelinux.org/vuln/CVE-2018-20030
ADVISORYsecurity-tracker.debian.org/tracker/CVE-2018-20030