Exiv2 CVE-2017-9239 Local Denial of Service Vulnerability

Bugtraq ID:	98720
Class:	Boundary Condition Error
CVE:	CVE-2017-9239
Remote:	No
Local:	Yes
Published:	May 26 2017 12:00AM
Updated:	May 26 2017 12:00AM
Credit:	lolopop and Young_x
Vulnerable:	Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Exiv2 Exiv2 0.26
Not Vulnerable:

Exiv2 CVE-2017-9239 Local Denial of Service Vulnerability

Exiv2 is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause denial-of-service conditions.

Exiv2 0.26 is vulnerable; other versions are also vulnerable.

Exiv2 CVE-2017-9239 Local Denial of Service Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

Exiv2 CVE-2017-9239 Local Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Exiv2 CVE-2017-9239 Local Denial of Service Vulnerability

References:

• Exiv2 Homepage (exiv2)
  
• exiv2: Segmentation fault in TiffImageEntry::doWriteImage function (Red Hat)
  
• poc/Segmentation fault in convert-test(exiv2) (Lolo-pop)
  
• Segmentation fault in convert-test (Exiv2)
  
• CVE-2017-9239 (RedHat)