CVE-2017-11592
HighSummary
There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input.
Risk Assessment
This vulnerability can be exploited by an attacker to remotely cause a denial of service, potentially leading to application downtime and loss of availability.
Recommendation
It is recommended to update Exiv2 to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access.
Other vulnerabilities in Exiv2 0.26
See all- CVE-2017-12955High
There is a heap-based buffer overflow in Exiv2 version 0.26 in basicio.cpp. The vulnerability causes an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact.
- CVE-2017-11591High
There is a floating point exception in the Exiv2::ValueType function in Exiv2 version 0.26 that can lead to a remote denial of service attack via crafted input.
- CVE-2017-11553High
There is an illegal address access in the extend_alias_table function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service.
- CVE-2017-9953High
Exiv2 version 0.26 has an invalid free in Image::printIFDStructure that leads to a segmentation fault. Crafted input can lead to a remote denial of service attack.
Original NVD description (English source)
There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input.