PT-2019-6380 · Exiv2+1 · Exiv2+1

D4N + 2 · Published 2019-08-12 · Updated 2019-08-30 · CVE-2019-14982

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 versions prior to 0.27.2

Description The issue is caused by an integer overflow in the WebPImage::getHeaderOffset function in webpimage.cpp, which can lead to a buffer overflow and a crash. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 0.27.2, update to version 0.27.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the WebPImage::getHeaderOffset function in webpimage.cpp until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2019-2468

ALT-PU-2019-2590

BDU:2023-05471

CVE-2019-14982

Affected Products

Alt Linux

Exiv2

References · 8

• 🔥 https://github.com/Exiv2/exiv2/issues/960 · Exploit
• https://github.com/Exiv2/exiv2/pull/962/commits/e925bc5addd881543fa503470c8a859e112cca62 · Patch
• https://github.com/Exiv2/exiv2/compare/v0.27.2-RC2...v0.27.2 · Patch
• https://security-tracker.debian.org/tracker/CVE-2019-14982 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14982 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-14982 · Security Note
• https://cxsecurity.com/cveshow/CVE-2019-14982 · Note