VulnerabilityModified

CVE-2018-14876

Attackers can trigger a longjmp that leads to an uninitialized stack frame after a libpng error concerning the IHDR image width.

MEDIUM 5.5EPSS 0.87%

Does this matter?

Lower severity and a low EPSS score (0.87%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in image_save_png in image/image-png.cpp in Free Lossless Image Format (FLIF) 0.3. Attackers can trigger a longjmp that leads to an uninitialized stack frame after a libpng error concerning the IHDR image width.

CVSS 3.0: 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 0.87% probability · 57th percentile
CISA KEV: Not listed
Affected: flif/flif
Source: cve@mitre.org

References

https://github.com/FLIF-hub/FLIF/issues/520Exploit, Third Party Advisory
https://github.com/FLIF-hub/FLIF/issues/520Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.