CVE-2017-17723

Summary

CVE	CVE-2017-17723
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2018-02-12 22:29:00 UTC
Updated	2019-10-03 00:03:00 UTC
Description	In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit this vulnerability to disclose memory data or cause a denial of service via a crafted TIFF file.

Risk And Classification

Problem Types: CWE-125

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Exiv2	Exiv2	0.26	All	All	All
Application	Exiv2	Exiv2	0.26	All	All	All

References

Reference	Source	Link	Tags
Exiv2: Multiple vulnerabilities (GLSA 201811-14) — Gentoo security	GENTOO	security.gentoo.org
1524104 – exiv2 library: heap-based buffer over-read in Exiv2::Image::byteSwap4 (image.cpp)	MISC	bugzilla.redhat.com	Exploit, Issue Tracking, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

671123 EulerOS Security Update for exiv2 (EulerOS-SA-2019-2144)
710310 Gentoo Linux Exiv2 Multiple Vulnerabilities (GLSA 201811-14)