PT-2019-6195 · Exiv2+2 · Exiv2+2

5Hadowblad3 · Publicado 2019-08-09 · Atualizado 2024-06-15 · CVE-2020-19716

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.27.1

Description A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 leads to a denial of service. The vulnerability is related to copying a buffer without checking the input data, allowing a remote attacker to cause a denial of service.

Recommendations For Exiv2 version 0.27.1, consider disabling the Databuf function in types.cpp as a temporary workaround until a patch is available. Restrict access to the types.cpp component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

BDU:2022-02070

CVE-2020-19716

DLA-3186-1

OPENSUSE-SU-2022_3889-1

OPENSUSE-SU-2024:12381-1

SUSE-SU-2022:3889-1

Produtos afetados

Astra Linux

Exiv2

Suse

Referências · 46

• https://github.com/Exiv2/exiv2/issues/980 · Nota
• https://github.com/Exiv2/exiv2/commit/109d5df7abd329f141b500c92a00178d35a6bef3 · Nota
• https://suse.com/security/cve/CVE-2017-1000128 · Nota
• https://suse.com/security/cve/CVE-2021-29457 · Nota
• https://suse.com/security/cve/CVE-2021-31291 · Nota
• https://bugzilla.suse.com/1068871 · Nota
• https://suse.com/security/cve/CVE-2021-37623 · Nota
• https://bugzilla.suse.com/1142679 · Nota
• https://suse.com/security/cve/CVE-2019-13108 · Nota
• https://bugzilla.suse.com/1186192 · Nota
• https://suse.com/security/cve/CVE-2020-19716 · Nota
• https://osv.dev/vulnerability/CVE-2020-19716 · Aviso do Fabricante
• https://bugzilla.suse.com/1189338 · Nota
• https://bugzilla.suse.com/1189335 · Nota
• https://suse.com/security/cve/CVE-2021-29623 · Nota