Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1524116 - exiv2 library: assertion aborted in Exiv2::(anonymous namespace)::readHeader (bigtiffimage.cpp)
exiv2 library: assertion aborted in Exiv2::(anonymous namespace)::readHeader ...
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: exiv2 (Show other bugs)
7.5-Alt
Unspecified Linux
unspecified Severity high
: rc
: ---
Assigned To: Jan Grulich
Desktop QE
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-12-10 02:35 EST by Wei You
Modified: 2017-12-10 02:35 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
poc to trigger the vulnerability (18 bytes, application/octet-stream)
2017-12-10 02:35 EST, Wei You
no flags Details

  None (edit)
Description Wei You 2017-12-10 02:35:12 EST
Created attachment 1365485 [details]
poc to trigger the vulnerability

on 0.26 (the latest version):

there is a reachable assertion aborted in Exiv2::(anonymous namespace)::readHeader in bigtiffimage.cpp, which can be triggered by poc_2.tiff in the attachment.

Note that this vulnerability exists in the exiv2 library, any software using
exiv2 will be affected by this vulnerability. Remote attackers can exploit
this vulnerability cause a denial of service via a crafted tiff file.

As a demonstration, please run the following command-line to trigger this
vulnerability:

./bin/exiv2 poc_2.tiff
exiv2: /homes/you58/exiv2/master/src/bigtiffimage.cpp:113: Exiv2::(anonymous namespace)::Header Exiv2::(anonymous namespace)::readHeader(Exiv2::BasicIo &): Assertion `size == 8' failed.
Aborted (core dumped)

Note You need to log in before you can comment on or make changes to this bug.