CVE-2019-13504

A vulnerability was found in exiv2. An integer wraparound could lead to an out-of-bounds read in the way MemIo is implemented. Reading from the memory buffer with MemIo::Impl::read() reads data beyond the buffer’s limits. An attacker could abuse this flaw by providing a specially crafted image that when read, would cause the application to crash or to leak sensitive data.

This issue did not affect the versions of exiv2 as shipped with Red Hat Enterprise Linux 7, and 8 as variables MemIo::Impl::size_ and MemIo::Impl::idx_ are of type long, making it impossible to trigger the integer wraparound that would lead to an out-of-bound read.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.