PT-2023-2138 · Unknown · Xiaozhuai Imageinfo

10Cksyiqiyinhangzhoutechnology · Published 2023-02-26 · Updated 2024-05-17 · CVE-2023-1190

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xiaozhuai imageinfo versions up to 3.0.3

Description A buffer overflow issue has been found in the imageinfo.hpp file of the xiaozhuai imageinfo library. This issue is related to the copying of a buffer without checking the size of the input data. The manipulation of this issue can lead to a buffer overflow, which requires local access to exploit. The exploit has been disclosed to the public and may be used, potentially allowing an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For xiaozhuai imageinfo versions up to 3.0.3, consider updating to a version later than 3.0.3 to resolve the buffer overflow issue. As a temporary workaround, consider restricting access to the imageinfo.hpp file to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2023-01876

CVE-2023-1190

Affected Products

Xiaozhuai Imageinfo

References · 10

• 🔥 https://github.com/xiaozhuai/imageinfo/issues/1 · Exploit
• 🔥 https://github.com/10cksYiqiyinHangzhouTechnology/imageinfo_poc · Exploit
• https://osv.dev/vulnerability/CVE-2023-1190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1190 · Security Note
• https://bdu.fstec.ru/vul/2023-01876 · Security Note
• https://t.me/cvenotify/45579 · Telegram Post
• https://vuldb.com/?ctiid.222362 · Note
• https://security.snyk.io/vuln/SNYK-UNMANAGED-XIAOZHUAIIMAGEINFO-3342031 · Note
• https://vuldb.com/?id.222362 · Note
• https://t.me/cibsecurity/59454 · Telegram Post