The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5483-1 advisory.

    It was discovered that Exempi incorrectly handled certain media files. If a user or automated system were     tricked into opening a specially crafted file, a remote attacker could cause Exempi to stop responding or     crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for exempi fixes the following issues :

  - CVE-2018-12648: Fixed a NULL pointer dereference (crash)     issue when processing webp files (bsc#1098946).

This update was imported from the SUSE:SLE-15:Update update project.

According to the version of the exempi package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Exempi is vulnerable to an issue that may manifest as a     NULL pointer dereference or an out-of-bounds access due     to not checking if vector is of required size before     accessing its elements. An attacker could use this to     cause a denial of service.(CVE-2018-12648)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for exempi fixes the following issues :

CVE-2018-12648: Fixed a NULL pointer dereference (crash) issue when processing webp files (bsc#1098946).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for **CVE-2018-12648**.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
162376	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Exempi vulnerabilities (USN-5483-1)	Nessus	Ubuntu Local Security Checks	high
126335	openSUSE Security Update : exempi (openSUSE-2019-1657)	Nessus	SuSE Local Security Checks	high
126333	openSUSE Security Update : exempi (openSUSE-2019-1649)	Nessus	SuSE Local Security Checks	high
126272	EulerOS 2.0 SP8 : exempi (EulerOS-SA-2019-1645)	Nessus	Huawei Local Security Checks	high
126158	SUSE SLED15 / SLES15 Security Update : exempi (SUSE-SU-2019:1603-1)	Nessus	SuSE Local Security Checks	high
120835	Fedora 29 : exempi (2018-d8824aeec5)	Nessus	Fedora Local Security Checks	high
120211	Fedora 28 : exempi (2018-05d08fddf8)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-12648

high

Tenable Plugins

high

high

high

high

high

high

high