CVE-2019-13108
Fixed in a distro release EPSS 1%
An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset.
Products: exiv2, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.11 | exiv2 | 0.27.2-r0 |
| Debian 12 | exiv2 | 0.27.2-6 |
| Debian 13 | exiv2 | 0.27.2-6 |
| Debian 14 | exiv2 | 0.27.2-6 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP4 | exiv2 | 0.27.5-150400.15.4.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP4 | exiv2-0_26 | 0.26-150400.9.16.1 |
| openSUSE Leap 15.4 | exiv2 | 0.27.5-150400.15.4.1 |
| openSUSE Leap 15.4 | exiv2-0_26 | 0.26-150400.9.16.1 |
| openSUSE Tumbleweed | exiv2 | 0.27.5-3.1 |