rpm package
suse/exiv2&distro=SUSE Linux Enterprise Server 12 SP4
pkg:rpm/suse/exiv2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4
Vulnerabilities (15)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-20421 | — | < 0.23-12.8.1 | 0.23-12.8.1 | Jan 27, 2020 | In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. | ||
| CVE-2019-17402 | — | < 0.23-12.8.1 | 0.23-12.8.1 | Oct 9, 2019 | Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size. | ||
| CVE-2019-13113 | — | < 0.23-12.8.1 | 0.23-12.8.1 | Jun 30, 2019 | Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file. | ||
| CVE-2019-13110 | — | < 0.23-12.8.1 | 0.23-12.8.1 | Jun 30, 2019 | A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file. | ||
| CVE-2018-17581 | Med | 6.5 | < 0.23-12.8.1 | 0.23-12.8.1 | Sep 28, 2018 | CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service. | |
| CVE-2018-11531 | Cri | 9.8 | < 0.23-12.5.1 | 0.23-12.5.1 | May 29, 2018 | Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. | |
| CVE-2018-10998 | Med | 6.5 | < 0.23-12.5.1 | 0.23-12.5.1 | May 12, 2018 | An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call. | |
| CVE-2018-10958 | Med | 6.5 | < 0.23-12.5.1 | 0.23-12.5.1 | May 10, 2018 | In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call. | |
| CVE-2017-17669 | Med | 5.5 | < 0.23-12.5.1 | 0.23-12.5.1 | Dec 13, 2017 | There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack. | |
| CVE-2017-14864 | Med | 5.5 | < 0.23-12.5.1 | 0.23-12.5.1 | Sep 29, 2017 | An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. | |
| CVE-2017-14862 | Med | 5.5 | < 0.23-12.5.1 | 0.23-12.5.1 | Sep 29, 2017 | An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. | |
| CVE-2017-14859 | Med | 5.5 | < 0.23-12.5.1 | 0.23-12.5.1 | Sep 29, 2017 | An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. | |
| CVE-2017-11683 | Med | 6.5 | < 0.23-12.5.1 | 0.23-12.5.1 | Jul 27, 2017 | There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. | |
| CVE-2017-11591 | Hig | 7.5 | < 0.23-12.5.1 | 0.23-12.5.1 | Jul 24, 2017 | There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. | |
| CVE-2017-9239 | Med | 6.5 | < 0.23-12.8.1 | 0.23-12.8.1 | May 26, 2017 | An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulne |
- CVE-2019-20421Jan 27, 2020affected < 0.23-12.8.1fixed 0.23-12.8.1
In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
- CVE-2019-17402Oct 9, 2019affected < 0.23-12.8.1fixed 0.23-12.8.1
Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.
- CVE-2019-13113Jun 30, 2019affected < 0.23-12.8.1fixed 0.23-12.8.1
Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file.
- CVE-2019-13110Jun 30, 2019affected < 0.23-12.8.1fixed 0.23-12.8.1
A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file.
- affected < 0.23-12.8.1fixed 0.23-12.8.1
CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service.
- affected < 0.23-12.5.1fixed 0.23-12.5.1
Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
- affected < 0.23-12.5.1fixed 0.23-12.5.1
An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call.
- affected < 0.23-12.5.1fixed 0.23-12.5.1
In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call.
- affected < 0.23-12.5.1fixed 0.23-12.5.1
There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack.
- affected < 0.23-12.5.1fixed 0.23-12.5.1
An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
- affected < 0.23-12.5.1fixed 0.23-12.5.1
An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
- affected < 0.23-12.5.1fixed 0.23-12.5.1
An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
- affected < 0.23-12.5.1fixed 0.23-12.5.1
There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
- affected < 0.23-12.5.1fixed 0.23-12.5.1
There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
- affected < 0.23-12.8.1fixed 0.23-12.8.1
An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulne