PT-2018-3938 · Exiv2+1 · Exiv2+1

Xiaoqx · Published 2017-05-08 · Updated 2019-02-27 · CVE-2018-9144

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.26

Description The issue is related to an out-of-bounds read in the Exiv2::Internal::binaryToString function in image.cpp. This could result in denial of service or information disclosure. Exploitation of the vulnerability may allow a remote attacker to cause a denial of service.

Recommendations For Exiv2 version 0.26, consider restricting access to the image.cpp component until a patch is available. As a temporary workaround, avoid using the Exiv2::Internal::binaryToString function in image.cpp to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2017-1574

BDU:2023-05470

CVE-2018-9144

Affected Products

Alt Linux

Exiv2

References · 19

• 🔥 https://github.com/Exiv2/exiv2/issues/254 · Exploit
• 🔥 https://github.com/xiaoqx/pocs/tree/master/exiv2 · Exploit
• 🔥 https://github.com/xiaoqx/pocs/blob/master/exiv2/readme.md · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9303 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9144 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-9144 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-9144 · Vendor Advisory
• https://security.gentoo.org/glsa/201811-14 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9304 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-9144 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-9144 · Security Note
• https://bdu.fstec.ru/vul/2023-05469 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-1574 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05470 · Security Note