Exiv2 'value.cpp' Remote Denial of Service Vulnerability

Bugtraq ID:	104607
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-18005
Remote:	Yes
Local:	No
Published:	Dec 31 2017 12:00AM
Updated:	Dec 31 2017 12:00AM
Credit:	Kirit Sankar Gupta
Vulnerable:	Exiv2 Exiv2 0.26
Not Vulnerable:

Exiv2 'value.cpp' Remote Denial of Service Vulnerability

Exiv2 is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition, denying service to legitimate users.

Exiv2 0.26 is vulnerable; other versions may also be affected.

Exiv2 'value.cpp' Remote Denial of Service Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

Exiv2 'value.cpp' Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Exiv2 'value.cpp' Remote Denial of Service Vulnerability

References:

• CVE-2017-18005: NULL Pointer Dereference while extracting metadata (Exiv2)
  
• Exiv2 Homepage (exiv2)
  
• Fix Print::printMetadatum when md.size() > 0 #199 (Exiv2)
  
• Bug 1531171 - (CVE-2017-18005) CVE-2017-18005 exiv2: null pointer dereference (Redhat)
  
• CVE-2017-18005 (Redhat)