Denial of Service Vulnerability in Exiv2 Image Processing Tool
CVE-2019-9143

8.8HIGH

Key Information:

Vendor

Exiv2

Status
Exiv2
Vendor
CVE Published:
25 February 2019

What is CVE-2019-9143?

An issue exists in Exiv2 version 0.27 that allows for infinite recursion within the Exiv2::Image::printTiffStructure function. This vulnerability can be exploited through a specially crafted TIFF file, potentially leading to a Denial of Service due to segmentation faults. Attackers may corrupt process execution, resulting in unresponsive applications or potentially unrevealed impacts that could compromise system integrity. It is crucial for users of Exiv2 to be aware of this vulnerability and to apply any available patches or mitigations.

References

https://research.loginsoft.com/bugs/uncontrolled-recursio...
x_refsource_MISC
https://github.com/Exiv2/exiv2/issues/711
x_refsource_MISC
http://www.securityfocus.com/bid/107161
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.