Bug 1524116 - exiv2 library: assertion aborted in Exiv2::(anonymous namespace)::readHeader (bigtiffimage.cpp)
Summary: exiv2 library: assertion aborted in Exiv2::(anonymous namespace)::readHeader ...
Status: VERIFIED
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: exiv2
Version: 7.5-Alt
Hardware: Unspecified
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Jan Grulich
QA Contact: Desktop QE
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-12-10 07:35 UTC by Wei You
Modified: 2019-04-16 12:06 UTC (History)
0 users

(edit)
Clone Of:
(edit)
Last Closed:


Attachments (Terms of Use)
poc to trigger the vulnerability (18 bytes, application/octet-stream)
2017-12-10 07:35 UTC, Wei You
no flags Details

Description Wei You 2017-12-10 07:35:12 UTC
Created attachment 1365485 [details]
poc to trigger the vulnerability

on 0.26 (the latest version):

there is a reachable assertion aborted in Exiv2::(anonymous namespace)::readHeader in bigtiffimage.cpp, which can be triggered by poc_2.tiff in the attachment.

Note that this vulnerability exists in the exiv2 library, any software using
exiv2 will be affected by this vulnerability. Remote attackers can exploit
this vulnerability cause a denial of service via a crafted tiff file.

As a demonstration, please run the following command-line to trigger this
vulnerability:

./bin/exiv2 poc_2.tiff
exiv2: /homes/you58/exiv2/master/src/bigtiffimage.cpp:113: Exiv2::(anonymous namespace)::Header Exiv2::(anonymous namespace)::readHeader(Exiv2::BasicIo &): Assertion `size == 8' failed.
Aborted (core dumped)

Comment 4 Jan Grulich 2019-01-28 16:08:26 UTC
Fixed with exiv2-0.27.0-1.el7_6.


Note You need to log in before you can comment on or make changes to this bug.