CVE-2017-18005 describes a Null Pointer Dereference vulnerability in Exiv2 version 0.26, specifically within the Exiv2::DataValue::toLong function in value.cpp, which can be triggered by specially crafted metadata in a TIFF file. This vulnerability primarily affects Debian Linux distributions and the Exiv2 library itself. Rated with a CVSS score of 5.5 (Medium), this vulnerability has a local attack vector and low attack complexity, requiring user interaction (e.g., opening a malicious TIFF file). A successful exploit could lead to a denial of service (system crash) due to the null pointer dereference, but does not impact confidentiality or integrity. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.26CPE matchmatch criteria | cpe:2.3:a:exiv2:exiv2:0.26:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.