PT-2015-7853 · Exiv2 · Exiv2

Published 2015-01-02 · Updated 2015-01-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.24

Description The issue is related to a buffer overflow in the RiffVideo::infoTagsHandler function, which can be triggered by a long IKEY INFO tag value in an AVI file, potentially causing a denial of service (crash).

Recommendations For Exiv2 version 0.24, as a temporary workaround, consider disabling the processing of IKEY INFO tags in AVI files until a patch is available.

Related Identifiers

PYSEC-2015-36

Affected Products

Exiv2

References · 8

• https://osv.dev/vulnerability/PYSEC-2015-36 · Vendor Advisory
• http://ubuntu.com/usn/USN-2454-1 · Note
• http://secunia.com/advisories/61801 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148382.html · Note
• http://dev.exiv2.org/projects/exiv2/repository/diff?rev=3264&rev_to=3263 · Note
• http://dev.exiv2.org/issues/960 · Note
• https://security.gentoo.org/glsa/201507-03 · Note
• http://securityfocus.com/bid/71912 · Note