CVE-2020-19716
exiv2: buffer overflow in Databuf function in types.cpp leads to DoS
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 13, 2021
Updated · June 27, 2026
Description
There's a flaw in exiv2. An attacker able to submit a crafted file to an application linked with exiv2 could trigger excessive resource consumption or a null pointer dereference, leading to an impact to application availability.
Statement
This flaw does not affect exiv2 as shipped with Red Hat Enterprise Linux 8; the fix is already applied. This flaw is out of support scope for exiv2 as shipped with Red Hat Enterprise Linux 7, and did not reproduce on it.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference