CVE-2019-17402

Name of the Vulnerable Software and Affected Versions Exiv2 version 0.27.2

Description The issue is related to a lack of validation in the Exiv2 library, specifically in the crwimage int.cpp module, which can lead to a crash when the getULong function is called from CiffDirectory::readDirectory. This is due to the absence of checks on the relationship between the total size and the offset and size. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For Exiv2 version 0.27.2, consider applying input validation to prevent buffer overflows, or restrict access to the crwimage int.cpp module until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.