NULL pointer dereference in Exempi - CVE-2018-12648

Vulnerability identifier: #VU18936

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-12648

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error in the WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp file. A remote attacker can use a specially crafted file to perform a denial of service (DoS) attack.

Exempi
exempi (Alpine package)
exempi (Ubuntu package)
libexempi3 (Ubuntu package)
exempi
libexempi8 (Ubuntu package)
Opensuse
Ubuntu
Fedora

Install update from vendor's website.

Exempi - update to 2.5.0
exempi (Alpine package) - update to 2.5.1-r0
exempi (Ubuntu package) - addressed in versions 2.4.5-2ubuntu0.1, 2.5.1-1ubuntu0.1, 2.5.2-1ubuntu0.21.10.1, 2.5.2-1ubuntu0.22.04.1
libexempi3 (Ubuntu package) - update to 2.4.5-2ubuntu0.1
exempi - addressed in versions 2.4.5-4.fc28, 2.4.5-4.fc29
libexempi8 (Ubuntu package) - addressed in versions 2.5.1-1ubuntu0.1, 2.5.2-1ubuntu0.21.10.1, 2.5.2-1ubuntu0.22.04.1

• https://bugs.freedesktop.org/show_bug.cgi?id=106981

• OpenSUSE Linux update for exempi
• OpenSUSE Linux update for exempi
• NULL pointer dereference in exempi (Alpine package)
• Ubuntu update for exempi
• Fedora 29 update for exempi
• Fedora 28 update for exempi