Resource management error in Exiv2 - CVE-2019-13112

Vulnerability identifier: #VU20307

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-13112

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to memory allocation error in PngChunk::parseChunkContent() function. A remote attacker can create a specially crafted PNG image, pass it to the application and perform a denial of service attack.

Exiv2
exiv2 (Alpine package)
exiv2-debuginfo
exiv2-debugsource
libexiv2-12
libexiv2-12-debuginfo
libexiv2-devel
exiv2
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Fedora

Install updates from vendor's website.

Exiv2 - update to 0.27.2
exiv2 (Alpine package) - update to 0.27.2-r0
exiv2-debuginfo - update to 0.23-12.18.1
exiv2-debugsource - update to 0.23-12.18.1
libexiv2-12 - update to 0.23-12.18.1
libexiv2-12-debuginfo - update to 0.23-12.18.1
libexiv2-devel - update to 0.23-12.18.1
exiv2 - update to 0.27.2-1.fc30

• https://github.com/Exiv2/exiv2/issues/845
• https://github.com/Exiv2/exiv2/pull/846
• https://usn.ubuntu.com/4056-1/

• Multiple vulnerabilities in Exiv2
• Resource management error in exiv2 (Alpine package)
• SUSE update for exiv2
• Fedora 30 update for exiv2