CVE-2024-25112
Published Feb 12, 2024
Last updated a month ago
Overview
- Description
- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function, `QuickTimeVideo::multipleEntriesDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted video file. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 5
- Impact score
- 3.6
- Exploitability score
- 1.3
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
- Severity
- MEDIUM
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exiv2:exiv2:0.28.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D635E637-28E9-4716-90DC-F33389FA523B"
},
{
"criteria": "cpe:2.3:a:exiv2:exiv2:0.28.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "272F7760-58A9-47EA-BEC8-DD0DB0F60BF5"
}
],
"operator": "OR"
}
]
}
]