VulnerabilityModified
CVE-2005-4676
Buffer overflow in Andreas Huggel Exiv2 before 0.9 does not null terminate strings before calling the sscanf function, which allows remote attackers to cause a denial of service (application crash) via images with crafted IPTC metadata.
MEDIUM 5.0EPSS 4.10%
Does this matter?
Lower severity and a low EPSS score (4.10%). Track it; it rarely justifies an emergency change on its own.
Description
Buffer overflow in Andreas Huggel Exiv2 before 0.9 does not null terminate strings before calling the sscanf function, which allows remote attackers to cause a denial of service (application crash) via images with crafted IPTC metadata.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 4.10% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- andreas huggel/exiv2
- Source
- cve@mitre.org
References
- http://dev.robotbattle.com/mantis/bug_view_advanced_page.php?bug_id=447
- http://home.arcor.de/ahuggel/exiv2/changelog.html
- http://secunia.com/advisories/18619Patch, Vendor Advisory
- http://www.securityfocus.com/bid/16400Exploit, Patch
- http://www.vupen.com/english/advisories/2006/0345
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24349
- http://dev.robotbattle.com/mantis/bug_view_advanced_page.php?bug_id=447
- http://home.arcor.de/ahuggel/exiv2/changelog.html
- http://secunia.com/advisories/18619Patch, Vendor Advisory
- http://www.securityfocus.com/bid/16400Exploit, Patch
- http://www.vupen.com/english/advisories/2006/0345
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24349
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.