Moderate: exiv2 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

Fixed packages 8

Vulnerabilities 29

• Medium 6.5
  CVE-2018-20096

  There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafte…

  exiv2 PyPI
  Dec 12, 2018
• Medium 6.5
  CVE-2018-20097

  There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A craft…

  exiv2 exiv2 Debian PyPI
  Dec 12, 2018
• Medium 6.5
  CVE-2018-20098

  There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted…

  exiv2 PyPI
  Dec 12, 2018
• Medium 6.5
  CVE-2018-20099

  There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will l…

  exiv2 PyPI
  Dec 12, 2018
• Medium 6.5
  CVE-2019-13114

  http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer…

  exiv2 exiv2 exiv2 exiv2 Debian Ubuntu Alpine PyPI
  Jun 30, 2019
• Unscored —
  CVE-2017-18005

  Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted met…

  exiv2 Debian
  Dec 31, 2017
• Unscored —
  CVE-2018-10772

  The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (…

  May 7, 2018
• Unscored —
  CVE-2018-11037

  In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an informa…

  exiv2 exiv2 Debian Ubuntu
  May 14, 2018
• Unscored —
  CVE-2018-14338

  samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple…

  exiv2 Debian
  Jul 17, 2018
• Unscored —
  CVE-2018-17229 Public exploit

  Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overf…

  Sep 19, 2018
• Unscored —
  CVE-2018-17230

  Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over…

  Sep 19, 2018
• Unscored —
  CVE-2018-17282

  An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.

  Sep 20, 2018
• Unscored —
  CVE-2018-17581

  CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive fun…

  exiv2 exiv2 Debian Ubuntu
  Sep 28, 2018
• Unscored —
  CVE-2018-18915

  There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted inp…

  Nov 3, 2018
• Unscored —
  CVE-2018-19107

  In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from…

  exiv2 exiv2 Debian Ubuntu
  Nov 8, 2018
• Unscored —
  CVE-2018-19108

  In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of servic…

  exiv2 exiv2 Debian Ubuntu
  Nov 8, 2018
• Unscored —
  CVE-2018-19535

  In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (applic…

  exiv2 exiv2 Debian Ubuntu
  Nov 26, 2018
• Unscored —
  CVE-2018-19607

  Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer…

  Nov 27, 2018
• Unscored —
  CVE-2018-4868

  The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of s…

  Jan 3, 2018
• Unscored —
  CVE-2018-9303

  In Exiv2 0.26, an assertion failure in BigTiffImage::readData in bigtiffimage.cpp results in an abort.

  Apr 4, 2018
• Unscored —
  CVE-2018-9304

  In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp could result in denial of service.

  Apr 4, 2018
• Unscored —
  CVE-2018-9305

  In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak,…

  Apr 4, 2018
• Unscored —
  CVE-2018-9306 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-17724. Reason: This candidate is a reservation duplicate of CVE-…

  Apr 4, 2018
• Unscored —
  CVE-2019-13109

  An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG…

  exiv2 exiv2 Debian Alpine
  Jun 30, 2019
• Unscored —
  CVE-2019-13111

  A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (lar…

  exiv2 Alpine
  Jun 30, 2019
• Unscored —
  CVE-2019-13112

  A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a deni…

  exiv2 exiv2 exiv2 Debian Ubuntu Alpine
  Jun 30, 2019
• Unscored —
  CVE-2019-13113

  Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid da…

  exiv2 exiv2 exiv2 Debian Ubuntu Alpine
  Jun 30, 2019
• Unscored —
  CVE-2019-20421

  In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, wit…

  exiv2 exiv2 exiv2 exiv2 Debian Ubuntu Azure Linux Alpine
  Jan 27, 2020
• Unscored —
  CVE-2019-9143

  An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file imag…

  exiv2 Debian
  Feb 25, 2019