CVE-2017-17725

In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp

published February 12, 2018

CVSS
—
EPSS
2%
Percentile
78.2
In the wild
Unconfirmed
What it is

In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp. Remote attackers can exploit the vulnerability to cause a denial of service via a crafted image file. Note that this vulnerability is different from CVE-2017-14864, which is an invalid memory address dereference.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01799 · 78.2th percentile
Published
2018-02-12T22:00Z
EPSS history
Timeline
  • 12 FEB 22:00Z
    In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp
    cvelistv5