Vulnerability Details CVE-2017-11683
There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.4%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.3
References
- http://www.securityfocus.com/bid/100030
- https://bugzilla.redhat.com/show_bug.cgi?id=1475124
- https://lists.debian.org/debian-lts-announce/2022/11/msg00013.html
- https://usn.ubuntu.com/3852-1/
- http://www.securityfocus.com/bid/100030
- https://bugzilla.redhat.com/show_bug.cgi?id=1475124
- https://lists.debian.org/debian-lts-announce/2022/11/msg00013.html
- https://usn.ubuntu.com/3852-1/
Products affected by CVE-2017-11683
-
cpe:2.3:a:exiv2:exiv2:0.26
-
cpe:2.3:o:canonical:ubuntu_linux:14.04
-
cpe:2.3:o:canonical:ubuntu_linux:16.04
-
cpe:2.3:o:canonical:ubuntu_linux:18.04
-
cpe:2.3:o:canonical:ubuntu_linux:18.10
-
cpe:2.3:o:debian:debian_linux:10.0