Log in Start free

Vulnerability · Published Feb 12, 2024 · Assigned by GitHub_M

CVE-2024-25112Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2

Medium 5.5

In plain English

A medium-severity uncontrolled resource consumption in exiv2 from Exiv2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function, `QuickTimeVideo::multipleEntriesDecoder`, was new in v0.28.0, so Exiv2 versions before v0.28 are _not_ affected. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted video file. This bug is fixed in version v0.28.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20exiv20.28.2-r0ALPINE-CVE-2024-25112
Alpine:v3.21exiv20.28.2-r0ALPINE-CVE-2024-25112
Alpine:v3.22exiv20.28.2-r0ALPINE-CVE-2024-25112
Alpine:v3.23exiv20.28.2-r0ALPINE-CVE-2024-25112
Alpine:v3.24exiv20.28.2-r0ALPINE-CVE-2024-25112
Debian:12exiv2no fix listedDEBIAN-CVE-2024-25112
Debian:13exiv20.28.3+dfsg-2DEBIAN-CVE-2024-25112
Debian:14exiv20.28.3+dfsg-2DEBIAN-CVE-2024-25112
PyPIexiv20.16.1PYSEC-2024-107
PyPIexiv20.16.1GHSA-crmj-qh74-2r36

Affected products (as reported)

VendorProductVersions
Exiv2 exiv2 >= 0.28.0 < 0.28.2

Weakness: CWE-400, CWE-674 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References