CVE-2018-16132

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed, resulting in a forced restart of the device.

Metrics

CVSS 3.0 8.6/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/bugtraq/2018/Aug/57Mailing List, Third Party Advisory
http://seclists.org/bugtraq/2018/Aug/57Mailing List, Third Party Advisory

Timeline

Published: Aug 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-161335.3Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.CVE-2018-161346.1Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.CVE-2018-161356.5The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web si CVE-2018-161368.8An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the s CVE-2018-161378.8An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections.CVE-2018-161384.8An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities.CVE-2018-161396.1Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the CVE-2018-16147.5IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote CVE-2018-161407.8A buffer underwrite vulnerability in get_line() (read.c) in fig2dev 3.2.7a allows an attacker to write prior to the beginning of the buffer CVE-2018-161416.5ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar in \application\User\Controller\ProfileController.class.php via an CVE-2018-161426.1PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.CVE-2018-161449.8The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command in