NetSight
IP …
medium6.5

CVE-2019-17402

Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int…

Impact

Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.

Affected products

VendorProductAffected versions
Exiv2Exiv2
Version 0.27.2
DebianDebian Linux
Versions 8.0, 10.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04, 19.10

Weakness classification

CWE-120

References