Lucene search

K
suseSuseOPENSUSE-SU-2018:1961-1
HistoryJul 14, 2018 - 3:09 a.m.

Security update for exiv2 (moderate)

2018-07-1403:09:16
lists.opensuse.org
35

EPSS

0.004

Percentile

73.5%

This update for exiv2 to 0.26 fixes the following security issues:

  • CVE-2017-14864: Prevent invalid memory address dereference in
    Exiv2::getULong that could have caused a segmentation fault and
    application crash, which leads to denial of service (bsc#1060995).
  • CVE-2017-14862: Prevent invalid memory address dereference in
    Exiv2::DataValue::read that could have caused a segmentation fault and
    application crash, which leads to denial of service (bsc#1060996).
  • CVE-2017-14859: Prevent invalid memory address dereference in
    Exiv2::StringValueBase::read that could have caused a segmentation fault
    and application crash, which leads to denial of service (bsc#1061000).
  • CVE-2017-14860: Prevent heap-based buffer over-read in the
    Exiv2::Jp2Image::readMetadata function via a crafted input that could
    have lead to a denial of service attack (bsc#1061023).
  • CVE-2017-11337: Prevent invalid free in the Action::TaskFactory::cleanup
    function via a crafted input that could have lead to a remote denial of
    service attack (bsc#1048883).
  • CVE-2017-11338: Prevent infinite loop in the
    Exiv2::Image::printIFDStructure function via a crafted input that could
    have lead to a remote denial of service attack (bsc#1048883).
  • CVE-2017-11339: Prevent heap-based buffer overflow in the
    Image::printIFDStructure function via a crafted input that could have
    lead to a remote denial of service attack (bsc#1048883).
  • CVE-2017-11340: Prevent Segmentation fault in the XmpParser::terminate()
    function via a crafted input that could have lead to a remote denial of
    service attack (bsc#1048883).
  • CVE-2017-12955: Prevent heap-based buffer overflow. The vulnerability
    caused an out-of-bounds write in Exiv2::Image::printIFDStructure(),
    which may lead to remote denial of service or possibly unspecified other
    impact (bsc#1054593).
  • CVE-2017-12956: Preventn illegal address access in
    Exiv2::FileIo::pathabi:cxx11 that could have lead to remote denial
    of service (bsc#1054592).
  • CVE-2017-12957: Prevent heap-based buffer over-read that was triggered
    in the Exiv2::Image::io function and could have lead to remote denial of
    service (bsc#1054590).
  • CVE-2017-11683: Prevent reachable assertion in the
    Internal::TiffReader::visitDirectory function that could have lead to a
    remote denial of service attack via crafted input (bsc#1051188).
  • CVE-2017-11591: Prevent Floating point exception in the Exiv2::ValueType
    function that could have lead to a remote denial of service attack via
    crafted input (bsc#1050257).
  • CVE-2017-11553: Prevent illegal address access in the extend_alias_table
    function via a crafted input could have lead to remote denial of service.
  • CVE-2017-11592: Prevent mismatched Memory Management Routines
    vulnerability in the Exiv2::FileIo::seek function that could have lead
    to a remote denial of service attack (heap memory corruption) via
    crafted input.

This update was imported from the SUSE:SLE-15:Update update project.