{"id":"CVE-2018-7998","aliases":["DEBIAN-CVE-2018-7998","DLA-1306-1","EUVD-2018-19710","GHSA-qvpx-7hqq-8g4f","UBUNTU-CVE-2018-7998","USN-6437-1"],"status":"published","title":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the...","description":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01645,"percentile":0.76609,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362","CWE-476"],"published":"2018-03-09T19:00:00Z","modified":"2026-10-24T14:08:49Z","fixes":[{"ecosystem":"Debian:12","package":"vips","fixed_in":["8.4.5-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vips","fixed_in":["8.4.5-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vips","fixed_in":["8.4.5-2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"vips","fixed_in":["7.28.5-1+deb7u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vips","fixed_in":["8.2.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vips","fixed_in":["8.4.5-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.5-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.5-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.5-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.28.5-1+deb7u2"}]}],"versions":["7.28.5-1","7.28.5-1+deb7u1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-1ubuntu0.1~esm1"}]}],"versions":["7.40.6-2ubuntu2","8.0.2-2","8.2.1-1","8.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.5-1ubuntu0.1~esm1"}]}],"versions":["8.4.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-1ubuntu0.1~esm1"}]}],"versions":["7.40.6-2ubuntu2","8.0.2-2","8.2.1-1","8.2.2-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.5-1ubuntu0.1~esm1"}]}],"versions":["8.4.5-1build1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-1ubuntu0.1~esm1"}]}],"versions":["8.10.5-2ubuntu1","8.11.4-2","8.12.1-1","8.12.1-1build1"],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libvips","product":"libvips"}],"references":[{"url":"https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5","tags":["x_refsource_MISC","x_transferred","Patch","fix","report"]},{"url":"https://github.com/jcupitt/libvips/issues/893","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7998"},{"url":"https://github.com/advisories/GHSA-qvpx-7hqq-8g4f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-7998","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-7998","tags":["report"]},{"url":"https://github.com/libvips/libvips/issues/893","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6437-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7998","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-6976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-20739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-27847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40032","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-7998","description":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.","status":"published","published":"2018-03-09T19:00:00Z","modified":"2024-08-05T06:37:59.638Z","updated_at":"2026-11-02T14:35:10.313768Z"}],"euvd":[{"id":"EUVD-2018-19710","description":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.","status":"published","published":"2018-03-09T19:00:00Z","modified":"2024-08-05T06:37:59Z","updated_at":"2026-11-03T02:40:04.215722Z"}],"ghsa":[{"id":"GHSA-qvpx-7hqq-8g4f","title":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the...","description":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.","status":"published","published":"2022-05-14T03:35:25Z","modified":"2023-02-02T05:07:52Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:52:36.533289Z"}],"nvd":[{"id":"CVE-2018-7998","description":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.","status":"published","published":"2018-03-09T19:29:01.07Z","modified":"2026-06-17T02:04:03.157Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362","CWE-476"],"updated_at":"2026-11-02T14:04:24.264003Z"}],"osv":[{"id":"CVE-2018-7998","description":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.","status":"published","published":"2018-03-09T19:29:01.07Z","modified":"2026-10-24T14:08:49.533871358Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"DEBIAN-CVE-2018-7998","description":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.","status":"published","published":"2018-03-09T19:29:01.07Z","modified":"2026-10-23T18:03:09.424051599Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2018-7998","description":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.","status":"published","published":"2018-03-09T19:29:00Z","modified":"2026-04-22T12:03:56.43481Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DLA-1306-1","title":"vips - security update","status":"published","published":"2018-03-11T00:00:00Z","modified":"2026-03-09T01:00:44.982941Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"USN-6437-1","title":"vips vulnerabilities","description":"Ziqiang Gu discovered that VIPS could be made to dereference a NULL \npointer. If a user or automated system were tricked into processing \na specially crafted input image file, an attacker could possibly use\nthis issue to cause a denial of service. This issue only affected \nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-7998)\n\nIt was discovered that VIPS did not properly handle uninitialized memory\nlocations when processing corrupted input image data. An attacker could \npossibly use this issue to generate output images that expose sensitive \ninformation. This issue only affected Ubuntu 16.04 LTS \nand Ubuntu 18.04 LTS. (CVE-2019-6976)\n\nIt was discovered that VIPS did not properly manage memory due to an \nuninitialized variable. If a user or automated system were tricked into \nprocessing a specially crafted output file, an attacker could possibly \nuse this issue to expose sensitive information. \nThis issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. \n(CVE-2020-20739)\n\nIt was discovered that VIPS could be made to divide by zero in multiple \nfuncions. If a user or automated system were tricked into processing a \nspecially crafted image file, an attacker could possibly use this issue \nto cause a denial of service. This issue only affected Ubuntu 16.04 LTS \nand Ubuntu 18.04 LTS. (CVE-2021-27847)\n\nIt was discovered that VIPS did not properly handle certain input files \nthat contained malformed UTF-8 characters. If a user or automated system \nwere tricked into processing a specially crafted SVG image file, an \nattacker could possibly use this issue to cause a denial of service. \nThis issue only affected Ubuntu 22.04 LTS. (CVE-2023-40032)\n","status":"published","published":"2023-10-18T14:40:28Z","modified":"2026-06-25T13:30:28.141211564Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}