Bug 1728481 (CVE-2019-13108) - CVE-2019-13108 exiv2: integer overflow PngImage::readMetadata leads to denial of service
Summary: CVE-2019-13108 exiv2: integer overflow PngImage::readMetadata leads to denial...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-13108
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1728482
Blocks: Embargoed1728496
TreeView+ depends on / blocked
 
Reported: 2019-07-10 04:53 UTC by Dhananjay Arunesh
Modified: 2021-02-16 21:45 UTC (History)
3 users (show)

Fixed In Version: exiv2 0.27.2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-07-16 14:40:43 UTC

Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-07-10 04:53:27 UTC 
An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset.

Reference:
https://github.com/Exiv2/exiv2/issues/789
https://github.com/Exiv2/exiv2/pull/794
Comment 1 Dhananjay Arunesh 2019-07-10 04:53:39 UTC 
Created exiv2 tracking bugs for this issue:

Affects: fedora-all [bug 1728482]
Comment 2 Riccardo Schirone 2019-07-16 13:39:28 UTC 
Upstream patch:
https://github.com/Exiv2/exiv2/commit/8cd95e221889e41e9cc153e2cfb5a7b41c7bc7a4
Comment 3 Riccardo Schirone 2019-07-16 13:47:58 UTC 
Statement:

This issue did not affect the versions of exiv2 as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they did not include the vulnerable code.
Comment 4 Product Security DevOps Team 2019-07-16 14:40:43 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-13108
Comment 5 Riccardo Schirone 2019-08-19 15:26:13 UTC 
The commits that introduce the vulnerable code are:
https://github.com/Exiv2/exiv2/commit/88f22e13cb1917ac94a95f95f74c9ee93c5472c8 (for the 0.27 version, introduced in 0.27.1)
https://github.com/Exiv2/exiv2/commit/9a38066b8eddf3948696a3362aac29e012ebe690 (on master)
Comment 6 Riccardo Schirone 2019-08-19 15:26:52 UTC 
Red Hat Enterprise Linux 7.7 ships exiv2 0.27.0, thus it is not vulnerable to this flaw.
Note You need to log in before you can comment on or make changes to this bug.