CVE-2018-9305: High severity exiv2 exiv2 vulnerability
In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0x1c" case.
Other sources
In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.cpp could result in a crash or information leak, due to use of the untrusted len value without any check.
References: https://github.com/Exiv2/exiv2/issues/263 https://github.com/xiaoqx/pocs/blob/master/exiv2/readme.md
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-9305?
CVE-2018-9305 is considered to have medium severity due to the potential for crashes and information leaks.
How do I fix CVE-2018-9305?
To fix CVE-2018-9305, update Exiv2 to the latest version beyond 0.26 that addresses this vulnerability.
What systems are affected by CVE-2018-9305?
CVE-2018-9305 affects Exiv2 versions prior to 0.26.
What are the potential consequences of CVE-2018-9305?
The potential consequences of CVE-2018-9305 include application crashes and exposure of sensitive information.
Is CVE-2018-9305 easy to exploit?
Exploitation of CVE-2018-9305 may require specific inputs to trigger the out-of-bounds read, making it moderately difficult to exploit.