#VU37111 Double Free in jpegoptim - CVE-2018-11416


| Updated: 2020-08-08

Vulnerability identifier: #VU37111

Vulnerability risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-11416

CWE-ID: CWE-415

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
jpegoptim
Other software / Other software solutions

Vendor: tjko (Timo Kokkonen)

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

jpegoptim.c in jpegoptim 1.4.5 (fixed in 1.4.6) has an invalid use of realloc() and free(), which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Mitigation
Install update from vendor's website.

Vulnerable software versions

jpegoptim: 1.4.5

External links
https://github.com/tjko/jpegoptim/blob/master/README
https://github.com/tjko/jpegoptim/issues/57

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Double Free in jpegoptim