Vulnerability Details CVE-2018-7998
In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 56.0%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.1
References
- https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5
- https://github.com/jcupitt/libvips/issues/893
- https://lists.debian.org/debian-lts-announce/2018/03/msg00009.html
- https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5
- https://github.com/jcupitt/libvips/issues/893
- https://lists.debian.org/debian-lts-announce/2018/03/msg00009.html
Products affected by CVE-2018-7998
-
cpe:2.3:a:libvips:libvips:7.28.0
-
cpe:2.3:a:libvips:libvips:7.30.0
-
cpe:2.3:a:libvips:libvips:8.0
-
cpe:2.3:a:libvips:libvips:8.1
-
cpe:2.3:a:libvips:libvips:8.2.2
-
cpe:2.3:a:libvips:libvips:8.2.3
-
cpe:2.3:a:libvips:libvips:8.3.0
-
cpe:2.3:a:libvips:libvips:8.4.2
-
cpe:2.3:a:libvips:libvips:8.4.6
-
cpe:2.3:a:libvips:libvips:8.5.1
-
cpe:2.3:a:libvips:libvips:8.5.2
-
cpe:2.3:a:libvips:libvips:8.5.3
-
cpe:2.3:a:libvips:libvips:8.5.4
-
cpe:2.3:a:libvips:libvips:8.5.5
-
cpe:2.3:a:libvips:libvips:8.5.6
-
cpe:2.3:a:libvips:libvips:8.5.7
-
cpe:2.3:a:libvips:libvips:8.5.8
-
cpe:2.3:a:libvips:libvips:8.5.9
-
cpe:2.3:a:libvips:libvips:8.6.0
-
cpe:2.3:a:libvips:libvips:8.6.1
-
cpe:2.3:a:libvips:libvips:8.6.2
-
cpe:2.3:o:debian:debian_linux:7.0