CVE-2017-18005: Null Pointer Dereference

Published Dec 31, 2017

Updated

Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a malformed TIFF file. The vulnerability causes a segmentation fault.

[UPSTREAM BUG] https://github.com/Exiv2/exiv2/issues/168

[UPSTREAM PATCH] https://github.com/Exiv2/exiv2/pull/199

Other sources

Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.

— MITRE

Affected Software

2 affected components

exiv2 exiv2=0.26

Debian Debian Linux=10.0

Event History

Dec 31, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Jan 4, 2018

Data Sourced

via Red Hat·06:03 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-18005?

CVE-2017-18005 has been classified as a moderate severity vulnerability due to potential denial-of-service risks.

How do I fix CVE-2017-18005?

To fix CVE-2017-18005, upgrade Exiv2 to the latest version that addresses this vulnerability.

What causes the CVE-2017-18005 vulnerability?

The CVE-2017-18005 vulnerability is caused by a null pointer dereference in the Exiv2::DataValue::toLong function when processing malformed TIFF file metadata.

Which software is affected by CVE-2017-18005?

CVE-2017-18005 affects Exiv2 version 0.26 and Debian GNU/Linux version 10.0.

Can CVE-2017-18005 lead to system crashes?

Yes, CVE-2017-18005 can lead to segmentation faults and potential system crashes due to the null pointer dereference.