A flaw was found in Exiv2 0.26. There is a integer underflow, leading to a
heap-based buffer over-read, in the Exiv2::IptcData::printStructure function in
iptc.cpp. Remote attackers can exploit this vulnerability to cause a denial of
service via a crafted TIFF file or, possibly, disclose memory data.
Created exiv2 tracking bugs for this issue:
Affects: fedora-all [bug 1545238]
This issue did not affect the versions of Exiv2 as shipped with Red Hat Enterprise Linux 6 and 7 as they did not include support for printing IPTC Photo Metadata.
*** Bug 1564284 has been marked as a duplicate of this bug. ***
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2019:2101 https://access.redhat.com/errata/RHSA-2019:2101
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):