Skip to content
OpenAdvisories
Low ALAS2-2019-1321 5 CVEs

Low: exempi security update (Amazon Linux 2)

Published Oct 21, 2019 · Updated Oct 23, 2019

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-7730: An integer wraparound, leading to a buffer overflow, was found in Exempi in the way it handles Adobe Photoshop Images. An attacker could exploit this to cause a denial of service via a crafted image file. 99999: CVE-2018-7730 exempi: Heap-based buffer overflow in PSD_MetaHandler::CacheFileData function in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp allows for denial of service via crafted XLS file CVE-2017-18238: An infinite loop has been discovered in Exempi in the way it handles Extensible Metadata Platform (XMP) data in QuickTime files. An attacker could cause a denial of service via a crafted file. 99999: CVE-2017-18238 exempi: Infinite loop in TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTime_Support.cpp CVE-2017-18236: An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted .asf file. 99999: CVE-2017-18236 exempi: Infinite loop in ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp CVE-2017-18234: An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFF_MemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFF_Support.hpp. 99999: CVE-2017-18234 exempi: Use after free via a PDF file containing JPEG data CVE-2017-18233: An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file. 99999: CVE-2017-18233 exempi: Infinite Loop in Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 exempi 0:2.2.0-9.amzn2
Amazon Linux · 2 exempi-debuginfo 0:2.2.0-9.amzn2
Amazon Linux · 2 exempi-devel 0:2.2.0-9.amzn2

Vulnerabilities 5

  • Unscored —

    An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RI…

  • Unscored —

    An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy…

  • Unscored —

    An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSup…

  • Unscored —

    An issue was discovered in Exempi before 2.4.4. The TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/Format…

  • Unscored —

    An issue was discovered in Exempi through 2.4.4. A certain case of a 0xffffffff length is mishandled in XMPFiles/source…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-18233.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-18234.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-18236.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-18238.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-7730.html