exiv2 - Multiple Denial of Service Vulnerabilities
Summary
DLA-1147-1: exiv2 - security update. Affects exiv2 versions < 0.23-1+deb7u2. Fixed in 0.23-1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
exiv2 is an open-source library used for parsing images' metadata. It is commonly relied upon by various applications. However, the library is vulnerable to multiple issues that can lead to denial of service attacks.
Vulnerability Detail
The exiv2 library is affected by several vulnerabilities:
-
CVE-2017-11591: This vulnerability allows an attacker to trigger a denial of service by exploiting a floating point exception in the Exiv2::ValueType function.
-
CVE-2017-11683: An attacker can cause a denial of service by triggering a failing assertion through a crafted image.
-
CVE-2017-14859, CVE-2017-14862, CVE-2017-14864: These vulnerabilities can be exploited by a crafted image to trigger invalid memory access, resulting in a denial of service.
How To Fix
Minimum fixed version
0.23-1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade exiv2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
The exiv2 library is vulnerable to multiple denial of service vulnerabilities. It is crucial to upgrade the exiv2 packages to the fixed version to mitigate the risk of exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for exiv2 →
FAQ
These vulnerabilities can lead to denial of service attacks, potentially causing affected applications to crash or become unresponsive.
There are no known public exploits for these vulnerabilities at the time of this advisory.
Yes, these vulnerabilities can be exploited remotely if an attacker can trick a user or an application into opening a crafted image file.
There is no evidence of active exploitation of these vulnerabilities at the time of this advisory.
In most cases, it is not necessary to restart the affected applications after applying the fix. However, it is recommended to review the documentation or consult the application vendor for specific instructions.
Related vulnerabilities
Recent vulnerabilities recorded for exiv2.
