REDHAT-BUG-1660423: Low severity centos dos2unix vulnerability
There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a denial of service attack.
Upstream issue:
https://github.com/Exiv2/exiv2/issues/590
References:
https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1660423?
The severity of REDHAT-BUG-1660423 is considered high due to the potential for denial of service attacks.
How do I fix REDHAT-BUG-1660423?
To fix REDHAT-BUG-1660423, update Exiv2 to the latest stable version that addresses the vulnerability.
What kind of impact does REDHAT-BUG-1660423 have on my system?
REDHAT-BUG-1660423 can lead to a denial of service, making the affected application unresponsive.
Which versions of Exiv2 are affected by REDHAT-BUG-1660423?
Exiv2 version 0.27-RC3 is specifically mentioned as having the vulnerability in REDHAT-BUG-1660423.
Is there a workaround for REDHAT-BUG-1660423?
Currently, there are no known workarounds for REDHAT-BUG-1660423; the best approach is to update the software.