CVE-2019-13114

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.htmlBroken Link
https://github.com/Exiv2/exiv2/issues/793Exploit, Patch, Third Party Advisory
https://github.com/Exiv2/exiv2/pull/815Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00004.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/
https://support.f5.com/csp/article/K45429077?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4056-1/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.htmlBroken Link
https://github.com/Exiv2/exiv2/issues/793Exploit, Patch, Third Party Advisory
https://github.com/Exiv2/exiv2/pull/815Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00004.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/
https://support.f5.com/csp/article/K45429077?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4056-1/Third Party Advisory

Timeline

Published: Jun 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-131158.1In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an CVE-2019-131169.8The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserializat CVE-2019-131175.3In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumber CVE-2019-131185.3In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/leng CVE-2019-131207.5Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrar CVE-2019-131217.5An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerabi CVE-2019-131226.1A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allo CVE-2019-131237.5Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Un CVE-2019-131247.5Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Un CVE-2019-131257.8HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation.CVE-2019-131267.5An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request. If authentication CVE-2019-131276.1An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products.