PT-2019-6193 · Exiv2+1 · Exiv2+1

92Wyunchao · Published 2019-08-23 · Updated 2023-12-22 · CVE-2020-18773

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.27.99.0

Description The issue is related to an invalid memory access in the decode function of the iptc.cpp component in the Exiv2 library, which can lead to a buffer overflow. This allows a remote attacker to cause a denial of service (DOS) by using a specially crafted tif file.

Recommendations For Exiv2 version 0.27.99.0, consider disabling the decode function in iptc.cpp as a temporary workaround to prevent exploitation until a patch is available. Restrict access to the iptc.cpp component to minimize the risk of denial of service attacks. Avoid using the affected Exiv2 library with untrusted tif files until the issue is resolved.

Exploit

Fix

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2022-02063

CVE-2020-18773

Affected Products

Debian

Exiv2

References · 12

• 🔥 https://github.com/Exiv2/exiv2/issues/760 · Exploit
• https://bdu.fstec.ru/vul/2022-02063 · Security Note
• https://osv.dev/vulnerability/CVE-2020-18773 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-18773 · Vendor Advisory
• https://security.gentoo.org/glsa/202312-06 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-18773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-18773 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-18773 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-18773 · Security Note
• https://ubuntu.com/security/CVE-2020-18773 · Vendor Advisory
• https://t.me/cvenotify/19963 · Telegram Post
• https://t.me/cibsecurity/27744 · Telegram Post