Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.5:Update
patchinfo.7770
_patchinfo
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _patchinfo of Package patchinfo.7770
<patchinfo incident="7770"> <issue tracker="bnc" id="1048883">VUL-1: CVE-2017-11336, CVE-2017-11337, CVE-2017-11338, CVE-2017-11339, CVE-2017-11340: exiv2: Multiple issues</issue> <issue tracker="bnc" id="1054593">VUL-0: CVE-2017-12955: exiv2: There is a heap-buffer-overflow in basicio.cpp of exiv2.</issue> <issue tracker="bnc" id="1061000">VUL-0: CVE-2017-14859: exiv2: Invalid memory address dereference in Exiv2::StringValueBase::read ( in value.cpp:302)</issue> <issue tracker="bnc" id="1060996">VUL-0: CVE-2017-14862: exiv2: Invalid memory address dereference in Exiv2::DataValue::read (value.cpp:193)</issue> <issue tracker="bnc" id="1060995">VUL-1: CVE-2017-14864: exiv2: Invalid memory address dereference in Exiv2::getULong(types.cpp:246)</issue> <issue tracker="bnc" id="1050257">VUL-0: CVE-2017-11591: exiv2: Floating point exception in Exiv2::ValueType</issue> <issue id="1051188" tracker="bnc">VUL-1: CVE-2017-11683: exiv2: DoS via triggered assertion in tiffvisitor.cpp</issue> <issue id="1054590" tracker="bnc">VUL-0: CVE-2017-12957: exiv2: There is a heap-buffer-overflow in the software exiv2 which is triggered in Exiv2::Image::io function.</issue> <issue id="1054592" tracker="bnc">VUL-0: CVE-2017-12956: exiv2: There is an illegal address access in Exiv2::FileIo::path[abi:cxx11]() of exiv2</issue> <issue id="1061023" tracker="bnc">VUL-0: exiv2: It is a heap-buffer-overflow in Exiv2::Jp2Image::readMetadata (jp2image.cpp:277)</issue> <issue tracker="cve" id="2017-11553"/> <issue tracker="cve" id="2017-11340"/> <issue tracker="cve" id="2017-14859"/> <issue tracker="cve" id="2017-11337"/> <issue tracker="cve" id="2017-12956"/> <issue tracker="cve" id="2017-11592"/> <issue tracker="cve" id="2017-11591"/> <issue tracker="cve" id="2017-11683"/> <issue tracker="cve" id="2017-12957"/> <issue tracker="cve" id="2017-14860"/> <issue tracker="cve" id="2017-12955"/> <issue tracker="cve" id="2017-14864"/> <issue tracker="cve" id="2017-14862"/> <issue tracker="cve" id="2017-11339"/> <issue tracker="cve" id="2017-11338"/> <category>security</category> <rating>moderate</rating> <packager>msmeissn</packager> <description>This update for exiv2 to 0.26 fixes the following security issues: - CVE-2017-14864: Prevent invalid memory address dereference in Exiv2::getULong that could have caused a segmentation fault and application crash, which leads to denial of service (bsc#1060995). - CVE-2017-14862: Prevent invalid memory address dereference in Exiv2::DataValue::read that could have caused a segmentation fault and application crash, which leads to denial of service (bsc#1060996). - CVE-2017-14859: Prevent invalid memory address dereference in Exiv2::StringValueBase::read that could have caused a segmentation fault and application crash, which leads to denial of service (bsc#1061000). - CVE-2017-14860: Prevent heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function via a crafted input that could have lead to a denial of service attack (bsc#1061023). - CVE-2017-11337: Prevent invalid free in the Action::TaskFactory::cleanup function via a crafted input that could have lead to a remote denial of service attack (bsc#1048883). - CVE-2017-11338: Prevent infinite loop in the Exiv2::Image::printIFDStructure function via a crafted input that could have lead to a remote denial of service attack (bsc#1048883). - CVE-2017-11339: Prevent heap-based buffer overflow in the Image::printIFDStructure function via a crafted input that could have lead to a remote denial of service attack (bsc#1048883). - CVE-2017-11340: Prevent Segmentation fault in the XmpParser::terminate() function via a crafted input that could have lead to a remote denial of service attack (bsc#1048883). - CVE-2017-12955: Prevent heap-based buffer overflow. The vulnerability caused an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact (bsc#1054593). - CVE-2017-12956: Preventn illegal address access in Exiv2::FileIo::path[abi:cxx11]() that could have lead to remote denial of service (bsc#1054592). - CVE-2017-12957: Prevent heap-based buffer over-read that was triggered in the Exiv2::Image::io function and could have lead to remote denial of service (bsc#1054590). - CVE-2017-11683: Prevent reachable assertion in the Internal::TiffReader::visitDirectory function that could have lead to a remote denial of service attack via crafted input (bsc#1051188). - CVE-2017-11591: Prevent Floating point exception in the Exiv2::ValueType function that could have lead to a remote denial of service attack via crafted input (bsc#1050257). - CVE-2017-11553: Prevent illegal address access in the extend_alias_table function via a crafted input could have lead to remote denial of service. - CVE-2017-11592: Prevent mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function that could have lead to a remote denial of service attack (heap memory corruption) via crafted input. </description> <summary>Security update for exiv2</summary> </patchinfo>
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor