CVE-2017-9239: exiv2 - Incorrect Data Structure in TIFF Image Entry
Summary
CVE-2017-9239: An issue was discovered in Exiv2 0.26. Affects exiv2 versions 0.1 – 0.3.1. No fix is published. How to fix ↓
Also tracked for
- exiv2 · Debian:11
The same CVE-2017-9239 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Exiv2 is an open-source image metadata library and toolset that allows users to read, write, and manipulate metadata in various image file formats. It provides functionality for extracting and modifying metadata such as EXIF, IPTC, and XMP data. This vulnerability affects version 0.26 of the Exiv2 package.
Vulnerability Detail
The vulnerability (CVE-2017-9239) in Exiv2 version 0.26 arises from an issue in the handling of the structure ifd data. When the data structure of the ifd is incorrect, the program assigns a null value (0x0) to pValue_, resulting in a segmentation fault when TiffImageEntry::doWriteImage attempts to use this null value. Exploiting this vulnerability requires the opening of a specially crafted TIFF file. The impact of this vulnerability can lead to a denial of service (DoS) condition.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability (CVE-2017-9239) in the Exiv2 package version 0.26 can result in a denial of service (DoS) condition when a specially crafted TIFF file is opened. To mitigate this risk, it is recommended to update to a version of Exiv2 beyond 0.26 that includes the patch for this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for exiv2 →
FAQ
Exiv2 is an open-source image metadata library and toolset used for reading, writing, and manipulating metadata in various image file formats.
The vulnerability can lead to a denial of service (DoS) condition when a specially crafted TIFF file is opened.
Updating to a version of Exiv2 beyond 0.26 that includes the patch for this vulnerability will mitigate the risk.
No specific workaround has been provided for this vulnerability.
For more information about this vulnerability, you can refer to the CVE-2017-9239 entry or the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for exiv2.
