CVE-2018-20099: exiv2 Infinite Loop

Vulnerability summary

CVE-2018-20099 is a medium (CVSS 6.5) Infinite Loop vulnerability in exiv2. EPSS estimates a 2.29% chance of exploitation in the next 30 days, higher than 82.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 12-12-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.