Bugzilla – Bug 1127463
VUL-0: CVE-2019-9144: exiv2: infinite recursion in BigTiffImage:printIFD in bigtiffimage.cpp causing denial of service
Last modified: 2024-05-07 09:21:53 UTC
rh#1683201 An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. References: https://bugzilla.redhat.com/show_bug.cgi?id=1683201 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9144 http://www.securityfocus.com/bid/107161 https://research.loginsoft.com/bugs/uncontrolled-recursion-loop-in-exiv2anonymous-namespacebigtiffimageprintifd-exiv2-0-27/ https://github.com/Exiv2/exiv2/issues/712
Created attachment 798519 [details] h2 QA REPRODUCER: exiv2 -b -u -k -p R pr h2 endless loop
There is a comment that this only affects debug builds. Will check.
(In reply to Dirk Mueller from comment #3) > There is a comment that this only affects debug builds. Will check. Hi, did you verify it? That might only be true from version 0.27 onwards: https://github.com/Exiv2/exiv2/issues/711#issuecomment-467209123
Verified again: bdd765ec4c84:/tmp # rpm -q exiv2 exiv2-0.26-150000.6.38.1.x86_64 bdd765ec4c84:/tmp # exiv2 -b -u -k -p R pr h2 exiv2: Action not available in Release mode: 'R' Usage: exiv2 [ options ] [ action ] file ... Manipulate the Exif metadata of images. bdd765ec4c84:/tmp # exiv2 -b -u -k pr h2 Exiv2 exception in print action for file h2: h2: The file contains data of an unknown image type we're not compiling the code.
All done, closing.