SUSE: 2022:4252-1 important: exiv2 | LinuxSecurity.com

What Are You Looking For?

Popular Tags

Contribute

   SUSE Security Update: Security update for exiv2
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:4252-1
Rating:             important
References:         #1119562 #1142681 #1185002 #1186231 #1188733 
                    #1189332 #1189337 #1189338 
Cross-References:   CVE-2018-20097 CVE-2019-13112 CVE-2021-29457
                    CVE-2021-29473 CVE-2021-31291 CVE-2021-32815
                    CVE-2021-34334 CVE-2021-37620
CVSS scores:
                    CVE-2018-20097 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2018-20097 (SUSE): 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2019-13112 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2019-13112 (SUSE): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
                    CVE-2021-29457 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
                    CVE-2021-29457 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
                    CVE-2021-29473 (NVD) : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
                    CVE-2021-29473 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-31291 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-32815 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-32815 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
                    CVE-2021-34334 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-34334 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-37620 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-37620 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected Products:
                    SUSE Linux Enterprise Server 12-SP2-BCL
                    SUSE Linux Enterprise Server 12-SP3-BCL
                    SUSE Linux Enterprise Server 12-SP4-LTSS
                    SUSE Linux Enterprise Server 12-SP5
                    SUSE Linux Enterprise Server for SAP 12-SP4
                    SUSE Linux Enterprise Server for SAP Applications 12-SP5
                    SUSE Linux Enterprise Software Development Kit 12-SP5
                    SUSE OpenStack Cloud 9
                    SUSE OpenStack Cloud Crowbar 9
______________________________________________________________________________

   An update that fixes 8 vulnerabilities is now available.

Description:

   This update for exiv2 fixes the following issues:

   - CVE-2019-13112: Fixed an uncontrolled memory allocation in
     PngChunk:parseChunkContent causing denial of service. (bsc#1142681)
   - CVE-2021-37620: Fixed out-of-bounds read in XmpTextValue:read().
     (bsc#1189332)
   - CVE-2021-34334: Fixed a DoS due to integer overflow in loop counter.
     (bsc#1189338)
   - CVE-2021-31291: Fixed a heap-based buffer overflow vulnerability in
     jp2image.cpp may lead to a denial of service via crafted metadata
     (bsc#1188733).
   - CVE-2021-32815: Fixed a deny-of-service due to assertion failure in
     crwimage_int.cpp (bsc#1189337).
   - CVE-2018-20097: Fixed SEGV in
     Exiv2::Internal::TiffParserWorker::findPrimaryGroupsu (bsc#1119562).
   - CVE-2021-29457: Fixed a heap buffer overflow when write metadata into a
     crafted image file (bsc#1185002).
   - CVE-2021-29473: Fixed out-of-bounds read in
     Exiv2::Jp2Image:doWriteMetadata (bsc#1186231).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud Crowbar 9:

      zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-4252=1

   - SUSE OpenStack Cloud 9:

      zypper in -t patch SUSE-OpenStack-Cloud-9-2022-4252=1

   - SUSE Linux Enterprise Software Development Kit 12-SP5:

      zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-4252=1

   - SUSE Linux Enterprise Server for SAP 12-SP4:

      zypper in -t patch SUSE-SLE-SAP-12-SP4-2022-4252=1

   - SUSE Linux Enterprise Server 12-SP5:

      zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4252=1

   - SUSE Linux Enterprise Server 12-SP4-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2022-4252=1

   - SUSE Linux Enterprise Server 12-SP3-BCL:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2022-4252=1

   - SUSE Linux Enterprise Server 12-SP2-BCL:

      zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2022-4252=1



Package List:

   - SUSE OpenStack Cloud Crowbar 9 (x86_64):

      exiv2-debuginfo-0.23-12.18.1
      exiv2-debugsource-0.23-12.18.1
      libexiv2-12-0.23-12.18.1
      libexiv2-12-debuginfo-0.23-12.18.1

   - SUSE OpenStack Cloud 9 (x86_64):

      exiv2-debuginfo-0.23-12.18.1
      exiv2-debugsource-0.23-12.18.1
      libexiv2-12-0.23-12.18.1
      libexiv2-12-debuginfo-0.23-12.18.1

   - SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64):

      exiv2-debuginfo-0.23-12.18.1
      exiv2-debugsource-0.23-12.18.1
      libexiv2-devel-0.23-12.18.1

   - SUSE Linux Enterprise Server for SAP 12-SP4 (ppc64le x86_64):

      exiv2-debuginfo-0.23-12.18.1
      exiv2-debugsource-0.23-12.18.1
      libexiv2-12-0.23-12.18.1
      libexiv2-12-debuginfo-0.23-12.18.1

   - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64):

      exiv2-debuginfo-0.23-12.18.1
      exiv2-debugsource-0.23-12.18.1
      libexiv2-12-0.23-12.18.1
      libexiv2-12-debuginfo-0.23-12.18.1

   - SUSE Linux Enterprise Server 12-SP4-LTSS (aarch64 ppc64le s390x x86_64):

      exiv2-debuginfo-0.23-12.18.1
      exiv2-debugsource-0.23-12.18.1
      libexiv2-12-0.23-12.18.1
      libexiv2-12-debuginfo-0.23-12.18.1

   - SUSE Linux Enterprise Server 12-SP3-BCL (x86_64):

      exiv2-debuginfo-0.23-12.18.1
      exiv2-debugsource-0.23-12.18.1
      libexiv2-12-0.23-12.18.1
      libexiv2-12-debuginfo-0.23-12.18.1

   - SUSE Linux Enterprise Server 12-SP2-BCL (x86_64):

      exiv2-debuginfo-0.23-12.18.1
      exiv2-debugsource-0.23-12.18.1
      libexiv2-12-0.23-12.18.1
      libexiv2-12-debuginfo-0.23-12.18.1


References:

   https://www.suse.com/security/cve/CVE-2018-20097.html
   https://www.suse.com/security/cve/CVE-2019-13112.html
   https://www.suse.com/security/cve/CVE-2021-29457.html
   https://www.suse.com/security/cve/CVE-2021-29473.html
   https://www.suse.com/security/cve/CVE-2021-31291.html
   https://www.suse.com/security/cve/CVE-2021-32815.html
   https://www.suse.com/security/cve/CVE-2021-34334.html
   https://www.suse.com/security/cve/CVE-2021-37620.html
   https://bugzilla.suse.com/1119562
   https://bugzilla.suse.com/1142681
   https://bugzilla.suse.com/1185002
   https://bugzilla.suse.com/1186231
   https://bugzilla.suse.com/1188733
   https://bugzilla.suse.com/1189332
   https://bugzilla.suse.com/1189337
   https://bugzilla.suse.com/1189338

SUSE: 2022:4252-1 important: exiv2

November 28, 2022
An update that fixes 8 vulnerabilities is now available

Summary

This update for exiv2 fixes the following issues: - CVE-2019-13112: Fixed an uncontrolled memory allocation in PngChunk:parseChunkContent causing denial of service. (bsc#1142681) - CVE-2021-37620: Fixed out-of-bounds read in XmpTextValue:read(). (bsc#1189332) - CVE-2021-34334: Fixed a DoS due to integer overflow in loop counter. (bsc#1189338) - CVE-2021-31291: Fixed a heap-based buffer overflow vulnerability in jp2image.cpp may lead to a denial of service via crafted metadata (bsc#1188733). - CVE-2021-32815: Fixed a deny-of-service due to assertion failure in crwimage_int.cpp (bsc#1189337). - CVE-2018-20097: Fixed SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroupsu (bsc#1119562). - CVE-2021-29457: Fixed a heap buffer overflow when write metadata into a crafted image file (bsc#1185002). - CVE-2021-29473: Fixed out-of-bounds read in Exiv2::Jp2Image:doWriteMetadata (bsc#1186231). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Crowbar 9: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-4252=1 - SUSE OpenStack Cloud 9: zypper in -t patch SUSE-OpenStack-Cloud-9-2022-4252=1 - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-4252=1 - SUSE Linux Enterprise Server for SAP 12-SP4: zypper in -t patch SUSE-SLE-SAP-12-SP4-2022-4252=1 - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4252=1 - SUSE Linux Enterprise Server 12-SP4-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2022-4252=1 - SUSE Linux Enterprise Server 12-SP3-BCL: zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2022-4252=1 - SUSE Linux Enterprise Server 12-SP2-BCL: zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2022-4252=1 Package List: - SUSE OpenStack Cloud Crowbar 9 (x86_64): exiv2-debuginfo-0.23-12.18.1 exiv2-debugsource-0.23-12.18.1 libexiv2-12-0.23-12.18.1 libexiv2-12-debuginfo-0.23-12.18.1 - SUSE OpenStack Cloud 9 (x86_64): exiv2-debuginfo-0.23-12.18.1 exiv2-debugsource-0.23-12.18.1 libexiv2-12-0.23-12.18.1 libexiv2-12-debuginfo-0.23-12.18.1 - SUSE Linux Enterprise Software Development Kit 12-SP5 (aarch64 ppc64le s390x x86_64): exiv2-debuginfo-0.23-12.18.1 exiv2-debugsource-0.23-12.18.1 libexiv2-devel-0.23-12.18.1 - SUSE Linux Enterprise Server for SAP 12-SP4 (ppc64le x86_64): exiv2-debuginfo-0.23-12.18.1 exiv2-debugsource-0.23-12.18.1 libexiv2-12-0.23-12.18.1 libexiv2-12-debuginfo-0.23-12.18.1 - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): exiv2-debuginfo-0.23-12.18.1 exiv2-debugsource-0.23-12.18.1 libexiv2-12-0.23-12.18.1 libexiv2-12-debuginfo-0.23-12.18.1 - SUSE Linux Enterprise Server 12-SP4-LTSS (aarch64 ppc64le s390x x86_64): exiv2-debuginfo-0.23-12.18.1 exiv2-debugsource-0.23-12.18.1 libexiv2-12-0.23-12.18.1 libexiv2-12-debuginfo-0.23-12.18.1 - SUSE Linux Enterprise Server 12-SP3-BCL (x86_64): exiv2-debuginfo-0.23-12.18.1 exiv2-debugsource-0.23-12.18.1 libexiv2-12-0.23-12.18.1 libexiv2-12-debuginfo-0.23-12.18.1 - SUSE Linux Enterprise Server 12-SP2-BCL (x86_64): exiv2-debuginfo-0.23-12.18.1 exiv2-debugsource-0.23-12.18.1 libexiv2-12-0.23-12.18.1 libexiv2-12-debuginfo-0.23-12.18.1

References

#1119562 #1142681 #1185002 #1186231 #1188733

#1189332 #1189337 #1189338

Cross- CVE-2018-20097 CVE-2019-13112 CVE-2021-29457

CVE-2021-29473 CVE-2021-31291 CVE-2021-32815

CVE-2021-34334 CVE-2021-37620

CVSS scores:

CVE-2018-20097 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2018-20097 (SUSE): 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2019-13112 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2019-13112 (SUSE): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2021-29457 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2021-29457 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2021-29473 (NVD) : 2.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2021-29473 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-31291 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-32815 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-32815 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

CVE-2021-34334 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-34334 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-37620 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-37620 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected Products:

SUSE Linux Enterprise Server 12-SP2-BCL

SUSE Linux Enterprise Server 12-SP3-BCL

SUSE Linux Enterprise Server 12-SP4-LTSS

SUSE Linux Enterprise Server 12-SP5

SUSE Linux Enterprise Server for SAP 12-SP4

SUSE Linux Enterprise Server for SAP Applications 12-SP5

SUSE Linux Enterprise Software Development Kit 12-SP5

SUSE OpenStack Cloud 9

SUSE OpenStack Cloud Crowbar 9

https://www.suse.com/security/cve/CVE-2018-20097.html

https://www.suse.com/security/cve/CVE-2019-13112.html

https://www.suse.com/security/cve/CVE-2021-29457.html

https://www.suse.com/security/cve/CVE-2021-29473.html

https://www.suse.com/security/cve/CVE-2021-31291.html

https://www.suse.com/security/cve/CVE-2021-32815.html

https://www.suse.com/security/cve/CVE-2021-34334.html

https://www.suse.com/security/cve/CVE-2021-37620.html

https://bugzilla.suse.com/1119562

https://bugzilla.suse.com/1142681

https://bugzilla.suse.com/1185002

https://bugzilla.suse.com/1186231

https://bugzilla.suse.com/1188733

https://bugzilla.suse.com/1189332

https://bugzilla.suse.com/1189337

https://bugzilla.suse.com/1189338

Severity
Announcement ID: SUSE-SU-2022:4252-1
Rating: important

News

Advisories

HOWTOs

Features

A Complete Guide to Security Automation & Reporting Using Open Source Tools
How to Check if Your Linux System is Infected with a Virus
Security Considerations for Azure Linux & Windows Subsystem for Linux Users
Admins Receive Automated Linux Patch Management & Improved Security with ManageEngine Endpoint Central
Linux Malware: The Truth About This Growing Threat [Updated]

About Us

Powered By

Footer Logo

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy. 

Learn More About Our Cookie Policy