A vulnerability was found in libvips up to 8.18.0. This affects the function vips_foreign_load_csv_build of the file libvips/foreign/csvload.c. The manipulation results in heap-based buffer overflow.
The attack requires a local approach. The exploit has been made public and could be used. The patch is identified as b3ab458a25e0e261cbd1788474bbc763f7435780.
It is advisable to implement a patch to correct this issue.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Libvips Libvips
cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*
|
— |
<= 8.18.0
|
References 8
https://github.com/libvips/libvips/
cna@vuldb.com
https://github.com/libvips/libvips/commit/b3ab458a25e0e261cbd1788474bbc763f7435…
cna@vuldb.com
https://github.com/libvips/libvips/issues/4874
cna@vuldb.com
https://github.com/libvips/libvips/issues/4874#issue-3943617697
cna@vuldb.com
https://github.com/libvips/libvips/pull/4894
cna@vuldb.com
https://vuldb.com/?ctiid.347653
cna@vuldb.com
https://vuldb.com/?id.347653
cna@vuldb.com
https://vuldb.com/?submit.758692
cna@vuldb.com