#VU20308 Reachable Assertion in Exiv2 - CVE-2019-13113


Vulnerability identifier: #VU20308

Vulnerability risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2019-13113

CWE-ID: CWE-617

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Exiv2
Universal components / Libraries / Libraries used by multiple products

Vendor: GNU

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion due to assertion failure) via an invalid data location in a CRW image file. A remote attacker can cause a denial of service (crash.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Exiv2: 0.23 - 0.27.1


External links
https://github.com/Exiv2/exiv2/issues/841
https://github.com/Exiv2/exiv2/pull/842
https://usn.ubuntu.com/4056-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.


Latest bulletins with this vulnerability