CVE-2017-14859
exiv2: An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26
CVE-2017-14859 is fixed in 2 products on 1 platform, first by exiv2 0.25-3.1ubuntu0.18.04.2, released September 27, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0107
65th percentile
An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| exiv2 · Ubuntu 18.04.6 LTS (bionic) | 0.25-3.1ubuntu0.18.04.2 | exiv2 0.25-3.1ubuntu0.18.04.2 | Sep 27, 2018 |
| libexiv2-14 · Ubuntu 18.04.6 LTS (bionic) | 0.25-3.1ubuntu0.18.04.2 | libexiv2-14 0.25-3.1ubuntu0.18.04.2 | Sep 27, 2018 |