Description
There is a reachable assertion in the Internal::TiffReader::visitDirectory
function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote denial
of service attack via crafted input.
Notes
| mdeslaur | first commit skips the issue, third commit is actual fix. |
Package
| Upstream: | needs-triage
|
| Ubuntu 18.04 LTS: | released
(0.25-3.1ubuntu0.18.04.2)
|
| Ubuntu 16.04 ESM: | released
(0.25-2.1ubuntu16.04.3)
|
| Ubuntu 14.04 ESM: | DNE
(trusty was released [0.23-1ubuntu2.2])
|
Patches:
Updated: 2022-04-13 12:53:00 UTC (commit f411bd370d482ef4385c4e751d121a4055fbc009)