Security update for exiv2 (important)

An update that solves 15 vulnerabilities, contains one
feature and has one errata is now available.

Description:

This update for exiv2 fixes the following issues:

Updated to version 0.27.5 (jsc#PED-1393):

• CVE-2017-1000128: Fixed stack out of bounds read in JPEG2000 parser
  (bsc#1068871).
• CVE-2019-13108: Fixed integer overflow PngImage:readMetadata
  (bsc#1142675).
• CVE-2020-19716: Fixed buffer overflow vulnerability in the Databuf
  function in types.cpp (bsc#1188645).
• CVE-2021-29457: Fixed heap buffer overflow when write metadata into a
  crafted image file (bsc#1185002).
• CVE-2021-29470: Fixed out-of-bounds read in
  Exiv2:Jp2Image:encodeJp2Header (bsc#1185447).
• CVE-2021-29623: Fixed read of uninitialized memory (bsc#1186053).
• CVE-2021-31291: Fixed heap-based buffer overflow in jp2image.cpp
  (bsc#1188733).
• CVE-2021-32617: Fixed denial of service due to inefficient algorithm
  (bsc#1186192).
• CVE-2021-37620: Fixed out-of-bounds read in XmpTextValue:read()
  (bsc#1189332).
• CVE-2021-37621: Fixed DoS due to infinite loop in
  Image:printIFDStructure (bsc#1189333).
• CVE-2021-37622: Fixed DoS due to infinite loop in
  JpegBase:printStructure (bsc#1189334)
• CVE-2021-34334: Fixed DoS due to integer overflow in loop
  counter(bsc#1189338)
• CVE-2021-37623: Fixed DoS due to infinite loop in
  JpegBase:printStructure (bsc#1189335)
• CVE-2021-29463: Fixed out-of-bounds read in webpimage.cpp (bsc#1185913).
• CVE-2021-34334: Fixed DoS due to integer overflow in loop counter
  (bsc#1189338)
• CVE-2019-13111: Fixed integer overflow in WebPImage:decodeChunks that
  lead to denial of service (bsc#1142679)
• CVE-2021-29463: Fixed an out-of-bounds read was found in webpimage.cpp
  (bsc#1185913)

Bugfixes:

• Fixed build using GCC 11 (bsc#1185218).

A new libexiv2-2_27 shared library is shipped, the libexiv2-2_26 is
provided only for compatibility now.

Please recompile your applications using the exiv2 library.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.4:

  zypper in -t patch openSUSE-SLE-15.4-2022-3889=1

• SUSE Linux Enterprise Module for Desktop Applications 15-SP4:

  zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-3889=1