CVE-2019-17402 Denial of service in n/a

Medium 6.5 Published 9 Oct 2019 Updated 5 Aug 2024

Attackers can cause a crash in the Exiv2 library by providing a malformed CRW image file, leading to a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-17402?

CVE-2019-17402 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 9 Oct 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.

Weakness: CWE-120

Which versions are affected by CVE-2019-17402?

It affects 3 products.

Linux distribution packages (33)

`exiv2-devel` AlmaLinux:8	All versions	`0.27.3-2.el8`
`exiv2-doc` AlmaLinux:8	All versions	`0.27.3-2.el8`
`exiv2` Red Hat:enterprise_linux:7::client	All versions	`0:0.27.0-3.el7_8`
`exiv2-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:0.27.0-3.el7_8`
`exiv2-devel` Red Hat:enterprise_linux:7::client	All versions	`0:0.27.0-3.el7_8`
`exiv2-doc` Red Hat:enterprise_linux:7::client	All versions	`0:0.27.0-3.el7_8`
`exiv2-libs` Red Hat:enterprise_linux:7::client	All versions	`0:0.27.0-3.el7_8`
`exiv2` Red Hat:enterprise_linux:7::computenode	All versions	`0:0.27.0-3.el7_8`
`exiv2-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:0.27.0-3.el7_8`
`exiv2-devel` Red Hat:enterprise_linux:7::computenode	All versions	`0:0.27.0-3.el7_8`
`exiv2-doc` Red Hat:enterprise_linux:7::computenode	All versions	`0:0.27.0-3.el7_8`
`exiv2-libs` Red Hat:enterprise_linux:7::computenode	All versions	`0:0.27.0-3.el7_8`
`exiv2` Red Hat:enterprise_linux:7::server	All versions	`0:0.27.0-3.el7_8`
`exiv2-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:0.27.0-3.el7_8`
`exiv2-devel` Red Hat:enterprise_linux:7::server	All versions	`0:0.27.0-3.el7_8`
`exiv2-doc` Red Hat:enterprise_linux:7::server	All versions	`0:0.27.0-3.el7_8`
`exiv2-libs` Red Hat:enterprise_linux:7::server	All versions	`0:0.27.0-3.el7_8`
`exiv2` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.27.0-3.el7_8`
`exiv2-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.27.0-3.el7_8`
`exiv2-devel` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.27.0-3.el7_8`
`exiv2-doc` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.27.0-3.el7_8`
`exiv2-libs` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.27.0-3.el7_8`
`exiv2` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.27.3-2.el8`
`exiv2-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.27.3-2.el8`
`exiv2-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.27.3-2.el8`
`exiv2-libs` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.27.3-2.el8`
`exiv2-libs-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.27.3-2.el8`
`exiv2-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:0.27.3-2.el8`
`exiv2-debugsource` Red Hat:enterprise_linux:8::crb	All versions	`0:0.27.3-2.el8`
`exiv2-devel` Red Hat:enterprise_linux:8::crb	All versions	`0:0.27.3-2.el8`
`exiv2-doc` Red Hat:enterprise_linux:8::crb	All versions	`0:0.27.3-2.el8`
`exiv2-libs-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:0.27.3-2.el8`
`exiv2` Rocky Linux:8	All versions	`0:0.27.3-2.el8`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Exiv2 Exiv2.

How do I fix CVE-2019-17402?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-17402 being exploited?

There is no known exploitation of CVE-2019-17402 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-17402, ALSA-2021:1758, AZL-7204, CLEANSTART-2024-BZ69967, DEBIAN-CVE-2019-17402, DLA-2019-1 and 6 more.