PT-2018-19195 · Exiv2 · Exiv2

Published 2018-09-28 · Updated 2018-09-28

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.26

Description The issue is related to excessive stack consumption due to a recursive function in CiffDirectory::readDirectory() at crwimage int.cpp, leading to a denial of service.

Recommendations For Exiv2 version 0.26, consider disabling the CiffDirectory::readDirectory() function as a temporary workaround until a patch is available. Restrict access to the crwimage int.cpp module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

PYSEC-2018-139

Affected Products

Exiv2

References · 7

• https://osv.dev/vulnerability/PYSEC-2018-139 · Vendor Advisory
• https://github.com/Exiv2/exiv2/issues/460 · Note
• https://github.com/SegfaultMasters/covering360/blob/master/Exiv2 · Note
• https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html · Note
• https://usn.ubuntu.com/3852-1 · Note
• https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html · Note
• https://access.redhat.com/errata/RHSA-2019:2101 · Note