Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2019-13111 |
CWE-ID | CWE-190 |
Exploitation vector | Network |
Public exploit | Public exploit code for vulnerability #1 is available. |
Vulnerable software |
openEuler Operating systems & Components / Operating system exiv2-help Operating systems & Components / Operating system package or component exiv2-devel Operating systems & Components / Operating system package or component exiv2 Operating systems & Components / Operating system package or component |
Vendor | openEuler |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU20306
Risk: Low
CVSSv4.0: 1.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2019-13111
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to integer overflow in WebPImage::decodeChunks() function. A remote attacker can create a specially crafted WEBP image, pass it to the application, trigger integer overflow and crash the affected application.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS
exiv2-help: before 0.26-20
exiv2-devel: before 0.26-20
exiv2: before 0.26-20
CPE2.3https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2020-1019
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.