CVE-2024-25112

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function, `QuickTimeVideo::multipleEntriesDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted video file. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:exiv2:exiv2:0.28.0:*:*:*:*:*:*:*
cpe:2.3:a:exiv2:exiv2:0.28.1:*:*:*:*:*:*:*

History

16 Oct 2024, 19:35

Type Values Removed Values Added
First Time Exiv2
Exiv2 exiv2
References () https://github.com/Exiv2/exiv2/pull/2337 - () https://github.com/Exiv2/exiv2/pull/2337 - Patch
References () https://github.com/Exiv2/exiv2/security/advisories/GHSA-crmj-qh74-2r36 - () https://github.com/Exiv2/exiv2/security/advisories/GHSA-crmj-qh74-2r36 - Vendor Advisory
CVSS v2 : unknown
v3 : 5.5
v2 : unknown
v3 : 5.0
CPE cpe:2.3:a:exiv2:exiv2:0.28.0:*:*:*:*:*:*:*
cpe:2.3:a:exiv2:exiv2:0.28.1:*:*:*:*:*:*:*

12 Feb 2024, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-12 23:15

Updated : 2024-10-16 19:35


NVD link : CVE-2024-25112

Mitre link : CVE-2024-25112

CVE.ORG link : CVE-2024-25112


JSON object : View

Products Affected

exiv2

  • exiv2
CWE
CWE-674

Uncontrolled Recursion

CWE-400

Uncontrolled Resource Consumption