Lucene search

Gentoo FoundationGLSA-201811-14

HistoryNov 24, 2018 - 12:00 a.m.

Exiv2: Multiple vulnerabilities

2018-11-2400:00:00

Gentoo Foundation

security.gentoo.org

146

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.019

Percentile

88.6%

JSON

Background

Exiv2 is a C++ library and a command line utility to manage image metadata.

Description

Multiple vulnerabilities have been discovered in Exiv2. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could cause a Denial of Service condition or obtain sensitive information via a specially crafted file.

Workaround

There is no known workaround at this time.

Resolution

All Exiv2 users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose
 "&gt;=media-gfx/exiv2-0.26_p20180811-r3"

OSVersionArchitecturePackageVersionFilename
Gentooanyallmedia-gfx/exiv2< 0.26_p20180811-r3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	media-gfx/exiv2	< 0.26_p20180811-r3	UNKNOWN

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.019

Percentile

88.6%

JSON

Related for GLSA-201811-14