A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-exiv2 | Jan 4, 2021 | Jun 30, 2019 | |
| Debian | debian-upgrade-exiv2 | Jan 12, 2023 | Jun 30, 2019 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-exiv2-libs | Dec 4, 2019 | Jun 30, 2019 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-exiv2-libs | Sep 25, 2019 | Jun 30, 2019 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-exiv2-libs | Sep 12, 2019 | Jun 30, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-exiv2huawei-euleros-2_0_sp8-upgrade-exiv2-libs | Aug 28, 2019 | Jun 30, 2019 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Jun 30, 2019 | |
| Suse | — | suse-upgrade-libexiv2-12suse-upgrade-libexiv2-devel | Apr 4, 2020 | Jun 30, 2019 |
| Ubuntu | ubuntu-upgrade-exiv2ubuntu-upgrade-libexiv2-14 | Jul 16, 2019 | Jun 30, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub