PT-2007-7513 · Exiv2 · Exiv2

Published 1970-01-01 · Updated 2024-07-19 · CVE-2007-6353

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions exiv2 library (affected versions not specified)

Description The issue is related to an integer overflow in the exif.cpp file of the exiv2 library, which allows context-dependent attackers to execute arbitrary code via a crafted EXIF file that triggers a heap-based buffer overflow. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-189

CWE-190

Related Identifiers

BDU:2015-03720

BDU:2015-03721

BDU:2015-03722

BDU:2015-03723

CVE-2007-6353

DSA-1474-1

OPENSUSE-SU-2024:10747-1

Affected Products

Exiv2

References · 42

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6353 · Security Note
• https://redhat.com/archives/fedora-package-announce/2007-December/msg00674.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03723 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-6353 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6353 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200712-16.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:006 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2007-December/msg00652.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03722 · Security Note
• http://ubuntu.com/usn/usn-655-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-6353 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03720 · Security Note
• https://bdu.fstec.ru/vul/2015-03721 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10747-1 · Vendor Advisory