CVE-2019-9143
exiv2: infinite recursion in Exiv2::Image::printTiffStructure in file image.cpp resulting in denial of service
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Se ha descubierto un problema en Exiv2 0.27. Hay una recursión infinita en Exiv2::Image::printTiffStructure en el archivo image.cpp. Esto puede desencadenarse mediante un archivo manipulado. Permite que un atacante provoque una denegación de servicio (fallo de segmentación) o, posiblemente, otro impacto sin especificar.
The exiv2 packages provide a command line utility which can display and manipulate image metadata such as EXIF, LPTC, and JPEG comments. Issues addressed include buffer overflow, denial of service, integer overflow, null pointer, and out of bounds read vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-02-25 CVE Reserved
- 2019-02-25 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-674: Uncontrolled Recursion
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/107161 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://github.com/Exiv2/exiv2/issues/711 | 2024-08-04 | |
| https://research.loginsoft.com/bugs/uncontrolled-recursion-loop-in-exiv2imageprinttiffstructure-exiv2-0-27 | 2024-08-04 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-9143 | 2020-04-28 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1684381 | 2020-04-28 |