PT-2019-6195 · Exiv2+2 · Exiv2+2

5Hadowblad3 · Published 2019-08-09 · Updated 2024-06-15 · CVE-2020-19716

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.27.1

Description A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 leads to a denial of service. The vulnerability is related to copying a buffer without checking the input data, allowing a remote attacker to cause a denial of service.

Recommendations For Exiv2 version 0.27.1, consider disabling the Databuf function in types.cpp as a temporary workaround until a patch is available. Restrict access to the types.cpp component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-02070

CVE-2020-19716

DLA-3186-1

OPENSUSE-SU-2022_3889-1

OPENSUSE-SU-2024:12381-1

SUSE-SU-2022:3889-1

Affected Products

Astra Linux

Exiv2

Suse

References · 46

• https://osv.dev/vulnerability/CVE-2020-19716 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3889-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3186-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12381-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-19716 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-19716 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1221SE17MD · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-19716 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02070 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0131SE47MD · Vendor Advisory
• https://github.com/Exiv2/exiv2/issues/980 · Note
• https://github.com/Exiv2/exiv2/commit/109d5df7abd329f141b500c92a00178d35a6bef3 · Note
• https://suse.com/security/cve/CVE-2017-1000128 · Note
• https://suse.com/security/cve/CVE-2021-29457 · Note
• https://suse.com/security/cve/CVE-2021-31291 · Note