PYSEC-2008-11
Exiv2 0.16 allows user-assisted remote attackers to cause a denial of service (divide-by-zero and application crash) via a zero value in Nikon lens information…
Not rated yet
Withdrawn Nov 22, 2024
PyPI
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
Exiv2 0.16 allows user-assisted remote attackers to cause a denial of service (divide-by-zero and application crash) via a zero value in Nikon lens information in the metadata of an image, related to "pretty printing" and the RationalValue::toLong function.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| exiv2 | all versions |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
References
Advisories
Exploits and evidence
Other links
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-m54q-mm9w-fp6g Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata | Medium | Also affects exiv2 |
| GHSA-496f-x7cq-cq39 Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file | Medium | Also affects exiv2 |
| GHSA-38h4-fx85-qcx7 Exiv2 allows Use After Free | Critical | Also affects exiv2 |
| GHSA-g9xm-7538-mq8w Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder | Medium | Also affects exiv2 |
| GHSA-crmj-qh74-2r36 Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder | Medium | Also affects exiv2 |
| PYSEC-2023-233 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. | High | Also affects exiv2 |
| PYSEC-2023-150 Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other… | High | Also affects exiv2 |
| PYSEC-2021-879 An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a… | Medium | Also affects exiv2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor