{"id":"CVE-2018-12648","aliases":["AZL-44871","DEBIAN-CVE-2018-12648","EUVD-2018-4603","GHSA-r54v-h92m-5v94","MGASA-2018-0416","SUSE-SU-2019:1603-1","UBUNTU-CVE-2018-12648","USN-5483-1","openSUSE-SU-2019:1649-1","openSUSE-SU-2019:1657-1","openSUSE-SU-2024:10745-1"],"status":"published","title":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has...","description":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02236,"percentile":0.82923,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-06-22T13:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:12","package":"exempi","fixed_in":["2.5.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exempi","fixed_in":["2.5.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exempi","fixed_in":["2.5.0-2"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"exempi","fixed_in":["2.4.5-1.1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"exempi","fixed_in":["2.4.5-3.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"exempi","fixed_in":["2.4.5-3.3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"exempi","fixed_in":["2.4.5-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"exempi","fixed_in":["2.4.5-lp150.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"exempi","fixed_in":["2.4.5-lp151.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-2"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1.1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-3.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-3.3.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-2ubuntu0.1"}]}],"versions":["2.4.3-1ubuntu1","2.4.5-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-2ubuntu0.1"}]}],"versions":["2.4.3-1ubuntu1","2.4.5-2"],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1ubuntu0.1"}]}],"versions":["2.5.1-1","2.5.1-1build1"],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1ubuntu0.22.04.1"}]}],"versions":["2.5.2-1build1"],"bundled":22},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-lp150.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"exempi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-1.3"}]}],"bundled":5}],"products":[{"vendor":"exempi_project","product":"exempi"}],"references":[{"url":"https://bugs.freedesktop.org/show_bug.cgi?id=106981","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00070.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00075.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12648","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r54v-h92m-5v94"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-12648","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0416.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23702","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WFS4YRRYY745JRYSEGGT7JFJTVC4F62H/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191603-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1098946","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12648","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-12648","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5483-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36045","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36047","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36048","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36051","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36052","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36053","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36054","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36056","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36058","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36064","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-39847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40716","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40732","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42528","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-42532","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DDT76AA5HPW76DKMVEO7Z73ZOISIOOZU/#DDT76AA5HPW76DKMVEO7Z73ZOISIOOZU","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M26NYQ376P5ITG743DIHSLGURU3HVBGM/#M26NYQ376P5ITG743DIHSLGURU3HVBGM","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7731","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-12648","description":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.","status":"published","published":"2018-06-22T13:00:00Z","modified":"2024-08-05T08:38:06.331Z","updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-4603","description":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.","status":"published","published":"2018-06-22T13:00:00Z","modified":"2024-08-05T08:38:06Z","updated_at":"2026-11-03T02:39:52.08472Z"}],"ghsa":[{"id":"GHSA-r54v-h92m-5v94","title":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has...","description":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.","status":"published","published":"2022-05-14T00:57:26Z","modified":"2023-02-02T05:02:40Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:51:29.373702Z"}],"nvd":[{"id":"CVE-2018-12648","description":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.","status":"published","published":"2018-06-22T13:29:00.387Z","modified":"2026-06-17T01:38:07Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:30.900603Z"}],"osv":[{"id":"AZL-44871","title":"CVE-2018-12648 affecting package exempi 2.6.5-1","description":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.","status":"published","published":"2018-06-22T13:29:00Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2018-12648","description":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.","status":"published","published":"2018-06-22T13:29:00.387Z","modified":"2026-04-16T06:16:21.635897174Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-12648","description":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.","status":"published","published":"2018-06-22T13:29:00.387Z","modified":"2026-10-23T18:03:19.01524388Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"UBUNTU-CVE-2018-12648","description":"The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference.","status":"published","published":"2018-06-22T13:29:00Z","modified":"2026-04-22T11:43:42.579578Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"MGASA-2018-0416","title":"Updated exempi packages fix security vulnerability","description":"It was found that the WEBP::GetLE32 function in\nXMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL\npointer dereference (CVE-2018-12648).\n","status":"published","published":"2018-10-26T18:47:14Z","modified":"2026-04-16T06:26:26.912769768Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1649-1","title":"Security update for exempi","description":"This update for exempi fixes the following issues:\n\n- CVE-2018-12648: Fixed a NULL pointer dereference (crash) issue when processing webp files (bsc#1098946).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-06-27T06:36:26Z","modified":"2026-02-04T02:21:29.794229Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1657-1","title":"Security update for exempi","description":"This update for exempi fixes the following issues:\n\n- CVE-2018-12648: Fixed a NULL pointer dereference (crash) issue when processing webp files (bsc#1098946).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-06-27T06:37:40Z","modified":"2026-02-04T02:30:39.811942Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10745-1","title":"exempi-tools-2.5.2-1.3 on GA media","description":"These are all security issues fixed in the exempi-tools-2.5.2-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:11.072912Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:1603-1","title":"Security update for exempi","description":"This update for exempi fixes the following issues:\n\n- CVE-2018-12648: Fixed a NULL pointer dereference (crash) issue when processing webp files (bsc#1098946).\n","status":"published","published":"2019-06-21T08:23:38Z","modified":"2026-02-04T02:37:05.96257Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-5483-1","title":"exempi vulnerabilities","description":"It was discovered that Exempi incorrectly handled certain media files. If a\nuser or automated system were tricked into opening a specially crafted\nfile, a remote attacker could cause Exempi to stop responding or crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2022-06-16T15:33:59Z","modified":"2026-04-27T16:19:01.82941766Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}