Bug 1114690 (CVE-2018-18915) - VUL-1: CVE-2018-18915: exiv2: There is an infinite loop in the Exiv2:Image:printIFDStructure function, which will lead to a denial of service.
Summary: VUL-1: CVE-2018-18915: exiv2: There is an infinite loop in the Exiv2:Image:pr...
Status: RESOLVED FIXED
Alias: CVE-2018-18915
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/218652/
Whiteboard: CVSSv3:SUSE:CVE-2018-18915:3.3:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2018-11-05 13:12 UTC by Robert Frohl
Modified: 2024-05-08 14:10 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
QA Reproducer (283 bytes, image/tiff)
2018-11-05 13:14 UTC, Robert Frohl 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2018-11-05 13:12:36 UTC 
CVE-2018-18915
There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted input will lead to a remote denial of service attack.

Upstream pullrequest:
https://github.com/Exiv2/exiv2/pull/517


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18915
http://www.cvedetails.com/cve/CVE-2018-18915/
Comment 1 Robert Frohl 2018-11-05 13:14:01 UTC 
Created attachment 788460 [details]
QA Reproducer

$ exiv2 -pC poc_infinite_loop
or
$ exiv2 -pR poc_infinite_loop
are causing an infinite loop
Comment 2 Robert Frohl 2018-11-05 13:15:56 UTC 
Hi Dirk,
my investigation of the upstream pull request suggests that only the following codestream is affected:
- SUSE:SLE-15:Update/exiv2
Comment 5 Dirk Mueller 2022-09-26 19:33:50 UTC 
submitted for SLE15
Comment 11 Swamp Workflow Management 2022-10-17 16:34:02 UTC 
SUSE-SU-2022:3598-1: An update that fixes 15 vulnerabilities is now available.

Category: security (important)
Bug References: 1076579,1086798,1086810,1092096,1114690,1185447,1186192,1188733,1188756,1189330,1189331,1189332,1189333,1189636,1189780
CVE References: CVE-2018-10772,CVE-2018-18915,CVE-2018-5772,CVE-2018-8976,CVE-2018-8977,CVE-2020-18898,CVE-2020-18899,CVE-2021-29470,CVE-2021-31291,CVE-2021-31292,CVE-2021-32617,CVE-2021-37618,CVE-2021-37619,CVE-2021-37620,CVE-2021-37621
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    exiv2-0.26-150000.6.16.1
openSUSE Leap 15.3 (src):    exiv2-0.26-150000.6.16.1
SUSE Manager Server 4.1 (src):    exiv2-0.26-150000.6.16.1
SUSE Manager Retail Branch Server 4.1 (src):    exiv2-0.26-150000.6.16.1
SUSE Manager Proxy 4.1 (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Server for SAP 15 (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Server 15-LTSS (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    exiv2-0.26-150000.6.16.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    exiv2-0.26-150000.6.16.1
SUSE Enterprise Storage 7 (src):    exiv2-0.26-150000.6.16.1
SUSE Enterprise Storage 6 (src):    exiv2-0.26-150000.6.16.1
SUSE CaaS Platform 4.0 (src):    exiv2-0.26-150000.6.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.