In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure.

Exiv2 update with security fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201811-14 (Exiv2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Exiv2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or obtain       sensitive information via a specially crafted file.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
120594	Fedora 28 : exiv2 (2018-8b67a5c7e2)	Nessus	Fedora Local Security Checks	high
119134	GLSA-201811-14 : Exiv2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
111620	Fedora 27 : exiv2 (2018-871fa4d189)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-9144

high

Tenable Plugins

high

critical

high