There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.26. A crafted input will lead to a remote denial of service attack.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - exiv2: integer overflow in the LoaderExifJpeg class in preview.cpp (CVE-2018-12265)

  - Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote     attackers to cause a denial of service (crash) via a long IKEY INFO tag value in an AVI file.
    (CVE-2014-9449)

  - exiv2 0.26 contains a Stack out of bounds read in webp parser (CVE-2017-1000126)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - exiv2: Heap-based buffer overflow in basicio.cpp (CVE-2017-12955)

  - Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote     attackers to cause a denial of service (crash) via a long IKEY INFO tag value in an AVI file.
    (CVE-2014-9449)

  - exiv2 0.26 contains a Stack out of bounds read in webp parser (CVE-2017-1000126)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for exiv2 to 0.26 fixes the following security issues :

  - CVE-2017-14864: Prevent invalid memory address     dereference in Exiv2::getULong that could have caused a     segmentation fault and application crash, which leads to     denial of service (bsc#1060995).

  - CVE-2017-14862: Prevent invalid memory address     dereference in Exiv2::DataValue::read that could have     caused a segmentation fault and application crash, which     leads to denial of service (bsc#1060996).

  - CVE-2017-14859: Prevent invalid memory address     dereference in Exiv2::StringValueBase::read that could     have caused a segmentation fault and application crash,     which leads to denial of service (bsc#1061000).

  - CVE-2017-14860: Prevent heap-based buffer over-read in     the Exiv2::Jp2Image::readMetadata function via a crafted     input that could have lead to a denial of service attack     (bsc#1061023).

  - CVE-2017-11337: Prevent invalid free in the     Action::TaskFactory::cleanup function via a crafted     input that could have lead to a remote denial of service     attack (bsc#1048883).

  - CVE-2017-11338: Prevent infinite loop in the     Exiv2::Image::printIFDStructure function via a crafted     input that could have lead to a remote denial of service     attack (bsc#1048883).

  - CVE-2017-11339: Prevent heap-based buffer overflow in     the Image::printIFDStructure function via a crafted     input that could have lead to a remote denial of service     attack (bsc#1048883).

  - CVE-2017-11340: Prevent Segmentation fault in the     XmpParser::terminate() function via a crafted input that     could have lead to a remote denial of service attack     (bsc#1048883).

  - CVE-2017-12955: Prevent heap-based buffer overflow. The     vulnerability caused an out-of-bounds write in     Exiv2::Image::printIFDStructure(), which may lead to     remote denial of service or possibly unspecified other     impact (bsc#1054593).

  - CVE-2017-12956: Preventn illegal address access in     Exiv2::FileIo::path[abi:cxx11]() that could have lead to     remote denial of service (bsc#1054592).

  - CVE-2017-12957: Prevent heap-based buffer over-read that     was triggered in the Exiv2::Image::io function and could     have lead to remote denial of service (bsc#1054590).

  - CVE-2017-11683: Prevent reachable assertion in the     Internal::TiffReader::visitDirectory function that could     have lead to a remote denial of service attack via     crafted input (bsc#1051188).

  - CVE-2017-11591: Prevent Floating point exception in the     Exiv2::ValueType function that could have lead to a     remote denial of service attack via crafted input     (bsc#1050257).

  - CVE-2017-11553: Prevent illegal address access in the     extend_alias_table function via a crafted input could     have lead to remote denial of service.

  - CVE-2017-11592: Prevent mismatched Memory Management     Routines vulnerability in the Exiv2::FileIo::seek     function that could have lead to a remote denial of     service attack (heap memory corruption) via crafted     input.

This update was imported from the SUSE:SLE-15:Update update project.

This update for exiv2 to 0.26 fixes the following security issues :

  - CVE-2017-14864: Prevent invalid memory address     dereference in Exiv2::getULong that could have caused a     segmentation fault and application crash, which leads to     denial of service (bsc#1060995).

  - CVE-2017-14862: Prevent invalid memory address     dereference in Exiv2::DataValue::read that could have     caused a segmentation fault and application crash, which     leads to denial of service (bsc#1060996).

  - CVE-2017-14859: Prevent invalid memory address     dereference in Exiv2::StringValueBase::read that could     have caused a segmentation fault and application crash,     which leads to denial of service (bsc#1061000).

  - CVE-2017-14860: Prevent heap-based buffer over-read in     the Exiv2::Jp2Image::readMetadata function via a crafted     input that could have lead to a denial of service attack     (bsc#1061023).

  - CVE-2017-11337: Prevent invalid free in the     Action::TaskFactory::cleanup function via a crafted     input that could have lead to a remote denial of service     attack (bsc#1048883).

  - CVE-2017-11338: Prevent infinite loop in the     Exiv2::Image::printIFDStructure function via a crafted     input that could have lead to a remote denial of service     attack (bsc#1048883).

  - CVE-2017-11339: Prevent heap-based buffer overflow in     the Image::printIFDStructure function via a crafted     input that could have lead to a remote denial of service     attack (bsc#1048883).

  - CVE-2017-11340: Prevent Segmentation fault in the     XmpParser::terminate() function via a crafted input that     could have lead to a remote denial of service attack     (bsc#1048883).

  - CVE-2017-12955: Prevent heap-based buffer overflow. The     vulnerability caused an out-of-bounds write in     Exiv2::Image::printIFDStructure(), which may lead to     remote denial of service or possibly unspecified other     impact (bsc#1054593).

  - CVE-2017-12956: Preventn illegal address access in     Exiv2::FileIo::path[abi:cxx11]() that could have lead to     remote denial of service (bsc#1054592).

  - CVE-2017-12957: Prevent heap-based buffer over-read that     was triggered in the Exiv2::Image::io function and could     have lead to remote denial of service (bsc#1054590).

  - CVE-2017-11683: Prevent reachable assertion in the     Internal::TiffReader::visitDirectory function that could     have lead to a remote denial of service attack via     crafted input (bsc#1051188).

  - CVE-2017-11591: Prevent Floating point exception in the     Exiv2::ValueType function that could have lead to a     remote denial of service attack via crafted input     (bsc#1050257).

  - CVE-2017-11553: Prevent illegal address access in the     extend_alias_table function via a crafted input could     have lead to remote denial of service.

  - CVE-2017-11592: Prevent mismatched Memory Management     Routines vulnerability in the Exiv2::FileIo::seek     function that could have lead to a remote denial of     service attack (heap memory corruption) via crafted     input.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199672	RHEL 6 : exiv2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199570	RHEL 7 : exiv2 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
123209	openSUSE Security Update : exiv2 (openSUSE-2019-504)	Nessus	SuSE Local Security Checks	high
120029	SUSE SLED15 / SLES15 Security Update : exiv2 (SUSE-SU-2018:1882-1)	Nessus	SuSE Local Security Checks	high
111098	openSUSE Security Update : exiv2 (openSUSE-2018-727)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-11338

medium

Tenable Plugins

high

high

high

high

high