CVE-2017-9239

An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file.

References

Affected packages

Git / github.com/exiv2/exiv2

Affected ranges

Type

GIT

Repo

https://github.com/exiv2/exiv2

Events

Introduced

Last affected

fa449a4d2c58d63f0d75ff259f25683a98a44630

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.26"
        }
    ]
}

Affected versions

v0.*

v0.10

v0.11

v0.12

v0.13

v0.14

v0.15

v0.16

v0.16-pre1

v0.17

v0.17.1

v0.18

v0.18-pre1

v0.18-pre2

v0.18.1

v0.18.2

v0.19

v0.20

v0.21

v0.21.1

v0.22

v0.23

v0.23.1

v0.24

v0.25

v0.26

v0.3

v0.4

v0.5

v0.6

v0.6.1

v0.6.2

v0.7

v0.8

v0.9

v0.9.1

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "14.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.10"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-9239.json"