PT-2019-5330 · Exiv2+7 · Exiv2+7

Published 2019-06-30 · Updated 2023-02-28 · CVE-2019-13113

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 versions prior to 0.27.2

Description The issue is related to insufficient input validation in the Exiv2 library for managing media file metadata. An attacker can exploit this by using a specially crafted CRW image file, potentially leading to a denial of service (crash due to assertion failure). The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Exiv2 versions prior to 0.27.2, update to version 0.27.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of CRW image files until a patch is available. Avoid using the Exiv2 library with untrusted input data to minimize the risk of exploitation.

Exploit

Fix

DoS

RCE

Assertion Failure

Weakness Enumeration

CWE-20

CWE-617

Related Identifiers

ALSA-2020:1577

ALT-PU-2019-2468

ALT-PU-2019-2590

BDU:2020-02399

CESA-2020_1577

CVE-2019-13113

MGASA-2019-0415

RHSA-2020:1577

RHSA-2020_1577

RLSA-2020:1577

SUSE-SU-2020:0860-1

USN-4056-1

Affected Products

Alt Linux

Almalinux

Centos

Exiv2

Red Hat

Rocky Linux

Suse

Ubuntu

References · 112

• 🔥 https://github.com/Exiv2/exiv2/issues/841 · Exploit
• https://github.com/Exiv2/exiv2/pull/842 · Patch
• https://ubuntu.com/security/CVE-2018-19108 · Vendor Advisory
• https://usn.ubuntu.com/4056-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0860-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13113 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-13113 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19107 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13110 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13113 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:1577 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13113 · Security Note
• https://advisories.mageia.org/MGASA-2019-0415.html · Security Note
• https://errata.almalinux.org/8/ALSA-2020-1577.html · Vendor Advisory