There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. A Crafted     input will lead to a denial of service attack. (CVE-2017-14865)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26     allows remote attackers to cause a denial of service     (heap-based buffer over-read) via a crafted image file,     a different vulnerability than     CVE-2018-10999.(CVE-2018-16336)

  - The Exiv2::Jp2Image::readMetadata function in     jp2image.cpp in Exiv2 0.26 allows remote attackers to     cause a denial of service (excessive memory allocation)     via a crafted file.(CVE-2018-4868)

  - In Exiv2 before v0.27.2, there is an integer overflow     vulnerability in the WebPImage::getHeaderOffset     function in webpimage.cpp. It can lead to a buffer     overflow vulnerability and a crash.(CVE-2019-14982)

  - There is a reachable assertion in the     Internal::TiffReader::visitDirectory function in     tiffvisitor.cpp of Exiv2 0.26 that will lead to a     remote denial of service attack via crafted     input.(CVE-2017-11683)

  - An Invalid memory address dereference was discovered in     Exiv2::StringValueBase::read in value.cpp in Exiv2     0.26. The vulnerability causes a segmentation fault and     application crash, which leads to denial of     service.(CVE-2017-14859)

  - An Invalid memory address dereference was discovered in     Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The     vulnerability causes a segmentation fault and     application crash, which leads to denial of     service.(CVE-2017-14862)

  - An Invalid memory address dereference was discovered in     Exiv2::getULong in types.cpp in Exiv2 0.26. The     vulnerability causes a segmentation fault and     application crash, which leads to denial of     service.(CVE-2017-14864)

  - There is a heap-based buffer overflow in the     Exiv2::us2Data function of types.cpp in Exiv2 0.26. A     Crafted input will lead to a denial of service     attack.(CVE-2017-14865)

  - There is a heap-based buffer over-read in the     Exiv2::Internal::PngChunk::keyTXTChunk function of     pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will     lead to a remote denial of service     attack.(CVE-2017-17669)

  - Exiv2 0.26 has a Null Pointer Dereference in the     Exiv2::DataValue::toLong function in value.cpp, related     to crafted metadata in a TIFF file.(CVE-2017-18005)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the exiv2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26     allows remote attackers to cause a denial of service     (heap-based buffer over-read) via a crafted image file,     a different vulnerability than     CVE-2018-10999.(CVE-2018-16336)

  - In Exiv2 0.26 and previous versions,     PngChunk::readRawProfile in pngchunk_int.cpp may cause     a denial of service (application crash due to a     heap-based buffer over-read) via a crafted PNG     file.(CVE-2018-19535)

  - A PngChunk::parseChunkContent uncontrolled memory     allocation in Exiv2 through 0.27.1 allows an attacker     to cause a denial of service (crash due to an     std::bad_alloc exception) via a crafted PNG image     file.(CVE-2019-13112)

  - Exiv2 0.26 has a Null Pointer Dereference in the     Exiv2::DataValue::toLong function in value.cpp, related     to crafted metadata in a TIFF file.(CVE-2017-18005)

  - There is a heap-based buffer overflow in the     Exiv2::us2Data function of types.cpp in Exiv2 0.26. A     Crafted input will lead to a denial of service     attack.(CVE-2017-14865)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for exiv2 fixes the following issues :

Security issues fixed :

  - CVE-2017-11591: There is a Floating point exception in     the Exiv2::ValueType function in Exiv2 0.26 that will     lead to a remote denial of service attack via crafted     input. (boo#1050257)

  - CVE-2017-11683: There is a reachable assertion in the     Internal::TiffReader::visitDirectory function in     tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote     denial of service attack via crafted input.
    (boo#1051188)

  - CVE-2017-14865: There is a heap-based buffer overflow in     the Exiv2::us2Data function of types.cpp in Exiv2 0.26.
    A Crafted input will lead to a denial of service attack.
    (boo#1061003)

  - CVE-2017-14862: An Invalid memory address dereference     was discovered in Exiv2::DataValue::read in value.cpp in     Exiv2 0.26. The vulnerability causes a segmentation     fault and application crash, which leads to denial of     service. (boo#1060996)

  - CVE-2017-14859: An Invalid memory address dereference     was discovered in Exiv2::StringValueBase::read in     value.cpp in Exiv2 0.26. The vulnerability causes a     segmentation fault and application crash, which leads to     denial of service. (boo#1061000)

ID	Name	Product	Family	Type	Severity
220605	Linux Distros Unpatched Vulnerability : CVE-2017-14865	Nessus	Misc.	Local	medium
132377	EulerOS 2.0 SP5 : exiv2 (EulerOS-SA-2019-2710)	Nessus	Huawei Local Security Checks	Local	medium
131343	EulerOS 2.0 SP8 : exiv2 (EulerOS-SA-2019-2277)	Nessus	Huawei Local Security Checks	Local	medium
104084	openSUSE Security Update : exiv2 (openSUSE-2017-1180)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2017-14865

medium

Tenable Plugins

medium

medium

medium

high