CVE-2022-24614

Description

When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.

Risk Information

Base Score

5.5

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.278

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-24613,CVE-2022-24614 are fixed in Drew-Noakes-metadata-extractor 2.18.0	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.3	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.4	Windows
Multiple Vulnerabilities are affected in IBM Security Guardium 11.5	Windows
Vulnerabilities CVE-2022-24613,CVE-2022-24614 are fixed in Drew-Noakes-metadata-extractor for Linux 2.18.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234