Lucene search
Veracode Vulnerability DatabaseVERACODE:20919HistoryJul 29, 2019 - 4:05 a.m.
Denial Of Service (DoS)
2019-07-2904:05:16
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
0.006 Low
EPSS
Percentile
78.1%
libexiv2.so is vulnerable to denial of service (DoS). The vulnerability exists because the function Exiv2::MrwImage::readMetadata() in mrwimage.cpp does not handle the bound checking properly, causing an application crash.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libexiv2.so | le | 26.0.0 | |
| libexiv2.so | le | 26.0.0 | |
| exiv2:buster | eq | 0.25-4+deb10u1 |
References
www.securityfocus.com/bid/109117
fuzzit.dev/2019/07/11/discovering-cve-2019-13504-cve-2019-13503-and-the-importance-of-api-fuzzing/
github.com/Exiv2/exiv2/commit/6ca49acd13bdf357ea4299ae0a747eca47868cc5#diff-1ae85636e7d473c614ac584f3a8ef08aR1155
github.com/Exiv2/exiv2/commit/bd0afe0390439b2c424d881c8c6eb0c5624e31d9
github.com/Exiv2/exiv2/pull/943
github.com/Exiv2/exiv2/pull/946
lists.debian.org/debian-lts-announce/2019/07/msg00015.html
lists.debian.org/debian-lts-announce/2023/01/msg00004.html
Related
cbl_mariner
cbl_mariner
CVE-2019-13504 affecting package exiv2 for versions less than 0.27.5-1
2022-06-25 20:53:09
debian
debian
[SECURITY] [DLA 1855-1] exiv2 security update
2019-07-19 14:06:55
[SECURITY] [DLA 3265-1] exiv2 security update
2023-01-10 17:02:40
alpinelinux
alpinelinux
CVE-2019-13504
2019-07-11 02:15:00
osv
osv
exiv2 - security update
2019-07-19 00:00:00
CVE-2019-13503
2019-07-11 02:15:10
CVE-2019-13504
2019-07-11 02:15:10
cvelist
cvelist
CVE-2019-13504
2019-07-11 00:00:00
nessus
nessus
Debian DLA-1855-1 : exiv2 security update
2019-07-22 00:00:00
Fedora 30 : exiv2 (2019-60553d5a18)
2019-08-12 00:00:00
Debian DLA-3265-1 : exiv2 - LTS security update
2023-01-11 00:00:00
debiancve
debiancve
CVE-2019-13504
2019-07-11 02:15:10
ubuntucve
ubuntucve
CVE-2019-13504
2019-07-11 00:00:00
CVE-2019-14368
2019-07-28 00:00:00
cve
cve
CVE-2019-13504
2019-07-11 02:15:10
openvas
openvas
Debian: Security Advisory (DLA-1855-1)
2019-07-20 00:00:00
Mongoose Web Server < 6.16 Buffer Overflow Vulnerability
2019-07-23 00:00:00
Debian: Security Advisory (DLA-3265-1)
2023-01-11 00:00:00
redhatcve
redhatcve
CVE-2019-13504
2019-07-11 09:21:42
prion
prion
Design/Logic Flaw
2019-07-11 02:15:00
nvd
nvd
CVE-2019-13504
2019-07-11 02:15:10