Vulnerability identifier: #VU20308
Vulnerability risk: Low
CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2019-13113
CWE-ID:
CWE-617
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Exiv2
Universal components / Libraries /
Libraries used by multiple products
Vendor: GNU
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion due to assertion failure) via an invalid data location in a CRW image file. A remote attacker can cause a denial of service (crash.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Exiv2: 0.23 - 0.27.1
External links
https://github.com/Exiv2/exiv2/issues/841
https://github.com/Exiv2/exiv2/pull/842
https://usn.ubuntu.com/4056-1/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.