1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
Candidate: CVE-2017-9239
PublicDate: 2017-05-26
References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9239
https://github.com/lolo-pop/poc/tree/master/Segmentation%20fault%20in%20convert-test(exiv2)
Description:
An issue was discovered in Exiv2 0.26. When the data structure of the
structure ifd is incorrect, the program assigns pValue_ to 0x0, and the
value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value
of pValue() to cause a segmentation fault. To exploit this vulnerability,
someone must open a crafted tiff file.
Ubuntu-Description:
Notes:
Bugs:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863410
http://dev.exiv2.org/issues/1296
http://dev.exiv2.org/issues/1295 (dupe)
Priority: low
Discovered-by:
Assigned-to:
Patches_exiv2:
upstream: https://github.com/Exiv2/exiv2/commit/2f8681e120d277e418941c4361c83b5028f67fd8
upstream_exiv2: released (0.25-3.1)
precise/esm_exiv2: DNE
trusty_exiv2: needed
vivid/stable-phone-overlay_exiv2: ignored (reached end-of-life)
vivid/ubuntu-core_exiv2: DNE
xenial_exiv2: needed
yakkety_exiv2: ignored (reached end-of-life)
zesty_exiv2: needed
devel_exiv2: not-affected (0.25-3.1)
|