{"id":"CVE-2018-7998","details":"In libvips before 8.6.3, a NULL function pointer dereference vulnerability was found in the vips_region_generate function in region.c, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted image file. This occurs because of a race condition involving a failed delayed load and other worker threads.","modified":"2026-08-07T15:00:16.470253Z","published":"2018-03-09T19:29:01.070Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00009.html"},{"type":"FIX","url":"https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5"},{"type":"EVIDENCE","url":"https://github.com/jcupitt/libvips/issues/893"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jcupitt/libvips","events":[{"introduced":"0"},{"fixed":"20d840e6da15c1574b3ed998bc92f91d1e36c2a5"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v8.6.2","v8.6.1","v8.6.0","v8.6.0-beta2","v8.6.0-beta1","v8.6.0-alpha2","v8.6.0-alpha1","v8.5.3","v8.5.2","v8.5.1","v8.3.0","v8.2.2","v8.1","v8.0-beta","v7.28.0"],"database_specific":{"vanir_signatures_modified":"2026-08-07T15:00:16Z","vanir_signatures":[{"digest":{"line_hashes":["306926423683472828317704438232217260033","277502447855396680736552641980594366635","60324371128634066185810503912703753954","46965884156854872856711803342893603777"],"threshold":0.9},"id":"CVE-2018-7998-2415b40c","signature_type":"Line","signature_version":"v1","source":"https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5","target":{"file":"libvips/include/vips/foreign.h"},"deprecated":false},{"id":"CVE-2018-7998-6b377808","signature_type":"Function","signature_version":"v1","source":"https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5","target":{"file":"libvips/foreign/foreign.c","function":"vips_foreign_load_start"},"deprecated":false,"digest":{"function_hash":"218512315501625304912560481540080997760","length":727}},{"id":"CVE-2018-7998-b7f96901","signature_type":"Line","signature_version":"v1","source":"https://github.com/jcupitt/libvips/commit/20d840e6da15c1574b3ed998bc92f91d1e36c2a5","target":{"file":"libvips/foreign/foreign.c"},"deprecated":false,"digest":{"line_hashes":["74971341457739111062111131691742175785","269345774935057705419413702627315801641","168304705553438508146335368674068646877","56335366994696899431774619255624391828","339680074312113606083540884884732141390","29243557630705950689171324433621822952","23393416851620940943205440885912574856","47612449997992787440572348434302158533","101420819265531338736456940068176335718","56780132785993053343655089612002781683","184858710503790449278907834426119569883","339659324962237870371255317078229467245"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-7998.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/libvips/libvips","events":[{"introduced":"0"},{"fixed":"29e05dabaf0772bac57bad63b2e09ce1c9298c4b"}],"database_specific":{"cpe":"cpe:2.3:a:libvips:libvips:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.6.3"}],"source":"CPE_RANGE"}}],"versions":["v8.6.2","v8.6.1","v8.6.0","v8.6.0-beta2","v8.6.0-beta1","v8.6.0-alpha2","v8.6.0-alpha1","v8.5.3","v8.5.2","v8.5.1","v8.3.0","v8.2.2","v8.1","v8.0-beta","v7.28.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-7998.json","vanir_signatures_modified":"2026-08-07T15:00:16Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["74971341457739111062111131691742175785","44772031049909002966425481476098777198","102701039234728829292451413723282066390","145609127429089827125319393627334277342","178398260312620861944776409928790400255","328738077399853880013936568294173244734","259987416250558282849050694309490209494","233140730868419980135888439614774466878","54581753103257050674532694059278708035","47813536290551216746321807822127493885","325053430058307081669778602120269925429","95521321950089192257447280734394407591","100603343823782997565240292078322801838","337152236042029709084901898249719314304","168170405060649004115573762720131899176","270610453301636106727844918001982753000","267164239819226960294607640470899918859"],"threshold":0.9},"id":"CVE-2018-7998-51caee8d","match_only_versions":["v7.28.0","v8.0-beta","v8.1","v8.2.2","v8.3.0","v8.5.1","v8.5.2","v8.5.3","v8.6.0","v8.6.0-alpha1","v8.6.0-alpha2","v8.6.0-beta1","v8.6.0-beta2","v8.6.1","v8.6.2"],"signature_type":"Line","signature_version":"v1","source":"https://github.com/libvips/libvips/commit/29e05dabaf0772bac57bad63b2e09ce1c9298c4b","target":{"file":"libvips/colour/icc_transform.c"}},{"source":"https://github.com/libvips/libvips/commit/29e05dabaf0772bac57bad63b2e09ce1c9298c4b","target":{"function":"vips_icc_import_build","file":"libvips/colour/icc_transform.c"},"deprecated":false,"digest":{"function_hash":"133729574824333541002856427186533978344","length":977},"id":"CVE-2018-7998-c1855c16","match_only_versions":["v7.28.0","v8.0-beta","v8.1","v8.2.2","v8.3.0","v8.5.1","v8.5.2","v8.5.3","v8.6.0","v8.6.0-alpha1","v8.6.0-alpha2","v8.6.0-beta1","v8.6.0-beta2","v8.6.1","v8.6.2"],"signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}