Low: exiv2 security, bug fix, and enhancement update (Oracle Linux 7)

Summary

Fixed packages 4

Vulnerabilities 22

• Medium 6.5
  CVE-2018-20096

  There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafte…

  exiv2 PyPI
  Dec 12, 2018
• Medium 6.5
  CVE-2018-20097

  There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A craft…

  exiv2 exiv2 Debian PyPI
  Dec 12, 2018
• Medium 6.5
  CVE-2018-20098

  There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted…

  exiv2 PyPI
  Dec 12, 2018
• Medium 6.5
  CVE-2018-20099

  There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will l…

  exiv2 PyPI
  Dec 12, 2018
• Unscored —
  CVE-2017-17724

  In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, rela…

  Feb 12, 2018
• Unscored —
  CVE-2018-10772

  The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (…

  May 7, 2018
• Unscored —
  CVE-2018-10958

  In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv…

  exiv2 exiv2 Debian Ubuntu
  May 10, 2018
• Unscored —
  CVE-2018-10998

  An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of servic…

  exiv2 exiv2 Debian Ubuntu
  May 12, 2018
• Unscored —
  CVE-2018-11037

  In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an informa…

  exiv2 exiv2 Debian Ubuntu
  May 14, 2018
• Unscored —
  CVE-2018-12264

  Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::Va…

  exiv2 exiv2 Debian Ubuntu
  Jun 13, 2018
• Unscored —
  CVE-2018-12265

  Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv…

  exiv2 exiv2 Debian Ubuntu
  Jun 13, 2018
• Unscored —
  CVE-2018-14046

  Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.

  Jul 13, 2018
• Unscored —
  CVE-2018-17282

  An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.

  Sep 20, 2018
• Unscored —
  CVE-2018-17581

  CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive fun…

  exiv2 exiv2 Debian Ubuntu
  Sep 28, 2018
• Unscored —
  CVE-2018-18915

  There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted inp…

  Nov 3, 2018
• Unscored —
  CVE-2018-19107

  In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from…

  exiv2 exiv2 Debian Ubuntu
  Nov 8, 2018
• Unscored —
  CVE-2018-19108

  In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of servic…

  exiv2 exiv2 Debian Ubuntu
  Nov 8, 2018
• Unscored —
  CVE-2018-19535

  In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (applic…

  exiv2 exiv2 Debian Ubuntu
  Nov 26, 2018
• Unscored —
  CVE-2018-19607

  Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer…

  Nov 27, 2018
• Unscored —
  CVE-2018-8976

  In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringForm…

  exiv2 Debian
  Mar 25, 2018
• Unscored —
  CVE-2018-8977

  In Exiv2 0.26, the Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp allows remote attackers to cause a deni…

  Mar 25, 2018
• Unscored —
  CVE-2018-9305

  In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak,…

  Apr 4, 2018