CVE-2019-13109

Un desbordamiento de enteros en Exiv2 hasta la versión 0.27.1, permite a un atacante causar una denegación de servicio (SIGSEGV) por medio de un archivo de imagen PNG creado, debido a que PngImage::readMetadata maneja de manera inapropiada una sustracción chunkLength - iccOffset.

An update that fixes 11 vulnerabilities is now available. This update for exiv2-0_26 fixes the following issues. Fixed improper validation of the total size to the offset and size leads to a crash in Exiv2::getULong in types.cpp. Fixed a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header. Fixed an excessive stack consumption CiffDirectory:readDirectory at crwimage_int.cpp. Infinite loop in Exiv2::Jp2Image::encodeJp2Header. Fixed SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroupsu. Fixed a floating point exception in Exiv2::ValueType. Fixed a heap-based buffer overflow in getData in preview.cpp. Fixed a deny-of-service due to assertion failure in crwimage_int.cpp. Fixed out-of-bounds read in Exiv2::Jp2Image:doWriteMetadata. Fixed a denial of service in PngImage:readMetadata. Fixed an integer-overflow and out-of-bounds read in CiffDirectory:readDirectory leads to denial of service.