Skip to content
OpenAdvisories
Medium USN-3852-1 9 CVEs

exiv2 vulnerabilities

Published Jan 10, 2019 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
CVE-2017-9239 only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2017-11591, CVE-2017-11683, CVE-2017-14859, CVE-2017-14862,
CVE-2017-14864, CVE-2017-17669, CVE-2017-9239, CVE-2018-16336,
CVE-2018-1758)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS exiv2 0.23-1ubuntu2.2
Ubuntu · 16.04 LTS 16.04:LTS exiv2 0.25-2.1ubuntu16.04.3
Ubuntu · 18.04 LTS 18.04:LTS exiv2 0.25-3.1ubuntu0.18.04.2

Vulnerabilities 9

  • Medium 6.5
    CVE-2017-9239

    An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns p…

    exiv2 exiv2 exiv2 Debian Ubuntu PyPI
  • Unscored —
    CVE-2017-11591

    There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2017-11683

    There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 th…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2017-14859

    An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vu…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2017-14862

    An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerab…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2017-14864

    An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability c…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2017-17669

    There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Ex…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-16336

    Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-base…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-17581

    CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive fun…

    exiv2 exiv2 Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2017-9239
  • report
    https://ubuntu.com/security/CVE-2017-11591
  • report
    https://ubuntu.com/security/CVE-2017-11683
  • report
    https://ubuntu.com/security/CVE-2017-14859
  • report
    https://ubuntu.com/security/CVE-2017-14862
  • report
    https://ubuntu.com/security/CVE-2017-14864
  • report
    https://ubuntu.com/security/CVE-2017-17669
  • report
    https://ubuntu.com/security/CVE-2018-16336
  • report
    https://ubuntu.com/security/CVE-2018-17581