CVE-2018-19107

In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-based buffer over-read) caused by an integer overflow via a crafted PSD image file.
Configurations

Configuration 1 (hide)

cpe:2.3:a:exiv2:exiv2:0.26:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

History

01 Mar 2023, 17:13

Type Values Removed Values Added
References (MLIST) https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html - (MLIST) https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html - Mailing List, Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2101 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2101 - Third Party Advisory
References (UBUNTU) https://usn.ubuntu.com/4056-1/ - (UBUNTU) https://usn.ubuntu.com/4056-1/ - Third Party Advisory
CPE cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
First Time Redhat enterprise Linux Desktop
Redhat
Redhat enterprise Linux Server
Canonical
Canonical ubuntu Linux
Redhat enterprise Linux Workstation

10 Jan 2023, 19:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html -

Information

Published : 2018-11-08 08:29

Updated : 2023-12-10 12:44


NVD link : CVE-2018-19107

Mitre link : CVE-2018-19107

CVE.ORG link : CVE-2018-19107


JSON object : View

Products Affected

redhat

  • enterprise_linux_desktop
  • enterprise_linux_workstation
  • enterprise_linux_server

debian

  • debian_linux

exiv2

  • exiv2

canonical

  • ubuntu_linux
CWE
CWE-125

Out-of-bounds Read

CWE-190

Integer Overflow or Wraparound