PT-2019-5691 · Exiv2+8 · Exiv2+8
C0D3Xpl0It
·
Published
2019-10-06
·
Updated
2023-01-13
·
CVE-2019-17402
CVSS v2.0
7.1
High
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Exiv2 version 0.27.2
Description
The issue is related to a lack of validation in the Exiv2 library, specifically in the
crwimage int.cpp module, which can lead to a crash when the getULong function is called from CiffDirectory::readDirectory. This is due to the absence of checks on the relationship between the total size and the offset and size. The vulnerability can be exploited by a remote attacker to cause a denial of service.Recommendations
For Exiv2 version 0.27.2, consider applying input validation to prevent buffer overflows, or restrict access to the
crwimage int.cpp module until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Exiv2
Red Hat
Rocky Linux
Suse
Ubuntu