CVE-2017-14859

Published: 28 September 2017

An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
exiv2 Launchpad, Ubuntu, Debian	artful	Ignored (end of life)
	bionic	Released (0.25-3.1ubuntu0.18.04.2)
	cosmic	Released (0.25-4ubuntu0.1)
	trusty	Released (0.23-1ubuntu2.2)
	upstream	Needs triage
	xenial	Released (0.25-2.1ubuntu16.04.3)
	zesty	Ignored (end of life)
	Patches: upstream: https://github.com/Exiv2/exiv2/commit/65f45a350516bfde4941d7906f2d67462f48d1ca upstream: https://github.com/Exiv2/exiv2/commit/da67c16f3d8f8431ae5c732126499f74ccca6a81 upstream: https://github.com/Exiv2/exiv2/commit/d4e4288d839d0d9546a05986771f8738c382060c upstream: https://github.com/Exiv2/exiv2/commit/c2c9fab580f8d6ea237718ad63921cde1d8980f7 upstream: https://github.com/Exiv2/exiv2/commit/1841c2afd79db92180286e175d574500745f5412 upstream: https://github.com/Exiv2/exiv2/commit/1b01704e7ab456bf6b716c3bd072701e0871f490

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›