PT-2015-7853 · Exiv2 · Exiv2

Publicado 2015-01-02 · Atualizado 2015-01-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.24

Description The issue is related to a buffer overflow in the RiffVideo::infoTagsHandler function, which can be triggered by a long IKEY INFO tag value in an AVI file, potentially causing a denial of service (crash).

Recommendations For Exiv2 version 0.24, as a temporary workaround, consider disabling the processing of IKEY INFO tags in AVI files until a patch is available.

Identificadores relacionados

PYSEC-2015-36

Produtos afetados

Exiv2

Referências · 8

• http://ubuntu.com/usn/USN-2454-1 · Nota
• http://secunia.com/advisories/61801 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148382.html · Nota
• https://osv.dev/vulnerability/PYSEC-2015-36 · Aviso do Fabricante
• http://dev.exiv2.org/projects/exiv2/repository/diff?rev=3264&rev_to=3263 · Nota
• http://dev.exiv2.org/issues/960 · Nota
• https://security.gentoo.org/glsa/201507-03 · Nota
• http://securityfocus.com/bid/71912 · Nota