Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

openSUSE: 2020:0482-1 Moderate: Exiv2 Buffer Overflow Issues

opensuse
Calendar Grey April 8, 2020
Dist Opensuse Esm H88
This release rectifies 11 concerns in exiv2 for openSUSE, tackling buffer overflows alongside vulnerabilities related to memory corruption.
An update that fixes 11 vulnerabilities is now available.

Description

This update for exiv2 fixes the following issues:

exiv2 was updated to latest 0.26 branch, fixing bugs and security issues:

- CVE-2017-1000126: Fixed an out of bounds read in webp parser

(bsc#1068873).

- CVE-2017-9239: Fixed a segmentation fault in

TiffImageEntry::doWriteImage function (bsc#1040973).

- CVE-2018-12264: Fixed an integer overflow in LoaderTiff::getData() which

might have led to an out-of-bounds read (bsc#1097600).

- CVE-2018-12265: Fixed integer overflows in LoaderExifJpeg which could

have led to memory corruption (bsc#1097599).

- CVE-2018-17229: Fixed a heap based buffer overflow in Exiv2::d2Data via

a crafted image (bsc#1109175).

- CVE-2018-17230: Fixed a heap based buffer overflow in Exiv2::d2Data via

a crafted image (bsc#1109176).

- CVE-2018-17282: Fixed a null pointer dereference in

Exiv2::DataValue::copy (bsc#1109299).

- CVE-2018-19108: Fixed an integer overflow in

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory moderate buffer overflow memory corruption exiv2 openSUSE installation patch

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2020-482=1

Package List

- openSUSE Leap 15.1 (i586 x86_64):

exiv2-0.26-lp151.7.3.1

exiv2-debuginfo-0.26-lp151.7.3.1

exiv2-debugsource-0.26-lp151.7.3.1

libexiv2-26-0.26-lp151.7.3.1

libexiv2-26-debuginfo-0.26-lp151.7.3.1

libexiv2-devel-0.26-lp151.7.3.1

libexiv2-doc-0.26-lp151.7.3.1

- openSUSE Leap 15.1 (x86_64):

libexiv2-26-32bit-0.26-lp151.7.3.1

libexiv2-26-32bit-debuginfo-0.26-lp151.7.3.1

- openSUSE Leap 15.1 (noarch):

exiv2-lang-0.26-lp151.7.3.1

References

https://www.suse.com/security/cve/CVE-2017-1000126.html

https://www.suse.com/security/cve/CVE-2017-9239.html

https://www.suse.com/security/cve/CVE-2018-12264.html

https://www.suse.com/security/cve/CVE-2018-12265.html

https://www.suse.com/security/cve/CVE-2018-17229.html

https://www.suse.com/security/cve/CVE-2018-17230.html

https://www.suse.com/security/cve/CVE-2018-17282.html

https://www.suse.com/security/cve/CVE-2018-19108.html

https://www.suse.com/security/cve/CVE-2018-19607.html

https://www.suse.com/security/cve/CVE-2018-9305.html

https://www.suse.com/security/cve/CVE-2019-13114.html

https://bugzilla.suse.com/1040973

https://bugzilla.suse.com/1068873

https://bugzilla.suse.com/1088424

https://bugzilla.suse.com/1097599

https://bugzilla.suse.com/1097600

https://bugzilla.suse.com/1109175

https://bugzilla.suse.com/1109176

https://bugzilla.suse.com/1109299

https://bugzilla.suse.com/1115364

https://bugzilla.suse.com/1117513

https://bugzilla.suse.com/1142684

--

Announcement ID: openSUSE-SU-2020:0482-1
Rating: moderate
Affected Products: openSUSE Leap 15.1

Topics%20covered

Topics Covered

security advisory moderate buffer overflow memory corruption exiv2 openSUSE installation patch

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here