Red Hat Security Advisory: exiv2 security, bug fix, and enhancement update
🔗 CVE IDs covered (25)
📋 Description
CVE-2017-17724 — exiv2: heap-buffer-overflow in Exiv2::IptcData::printStructure in src/iptc.cpp CVE-2018-4868 — exiv2: Excessive memory allocation in Exiv2::Jp2Image::readMetadata function in jp2image.cpp CVE-2018-8976 — exiv2: out-of-bounds read in Exiv2::Internal::stringFormat image.cpp CVE-2018-8977 — exiv2: invalid memory access in Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp CVE-2018-9305 — exiv2: out of bounds read in IptcData::printStructure in iptc.c CVE-2018-10772 — exiv2: OOB read in pngimage.cpp:tEXtToDataBuf() allows for crash via crafted file CVE-2018-10958 — exiv2: SIGABRT caused by memory allocation in types.cpp:Exiv2::Internal::PngChunk::zlibUncompress() CVE-2018-10998 — exiv2: SIGABRT by triggering an incorrect Safe::add call CVE-2018-10999 — exiv2: heap-based buffer over-read in parseTXTChunk function CVE-2018-11037 — exiv2: information leak via a crafted file CVE-2018-12264 — exiv2: integer overflow in getData function in preview.cpp CVE-2018-12265 — exiv2: integer overflow in the LoaderExifJpeg class in preview.cpp CVE-2018-14046 — exiv2: heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp CVE-2018-17282 — exiv2: NULL pointer dereference in Exiv2::DataValue::copy in value.cpp leading to application crash CVE-2018-17581 — exiv2: Stack overflow in CiffDirectory::readDirectory() at crwimage_int.cpp leading to denial of service CVE-2018-18915 — exiv2: infinite loop in Exiv2::Image::printIFDStructure function in image.cpp CVE-2018-19107 — exiv2: heap-based buffer over-read in Exiv2::IptcParser::decode in iptc.cpp CVE-2018-19108 — exiv2: infinite loop in Exiv2::PsdImage::readMetadata in psdimage.cpp CVE-2018-19535 — exiv2: heap-based buffer over-read in PngChunk::readRawProfile in pngchunk_int.cpp CVE-2018-19607 — exiv2: NULL pointer dereference in Exiv2::isoSpeed in easyaccess.cpp CVE-2018-20096 — exiv2: Heap-based buffer over-read in Exiv2::tEXtToDataBuf function resulting in a denial of service CVE-2018-20097 — exiv2: Segmentation fault in Exiv2::Internal::TiffParserWorker::findPrimaryGroups function CVE-2018-20098 — exiv2: Heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header resulting in a denial of service CVE-2018-20099 — exiv2: Infinite loop in Exiv2::Jp2Image::encodeJp2Header resulting in a denial of service CVE-2019-9143 — exiv2: infinite recursion in Exiv2::Image::printTiffStructure in file image.cpp resulting in denial of service
🔗 References (58)
- selfhttps://access.redhat.com/errata/RHSA-2019:2101
- externalhttps://access.redhat.com/security/updates/classification/#low
- externalhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1465061
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1470729
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1470737
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1470913
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1470946
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1470950
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1471772
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1473888
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1473889
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1475123
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1475124
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1482295
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1482296
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1482423
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1494443
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1494467
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1494776
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1494778
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1494780
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1494781
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1494782
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1494786
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1494787
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1495043
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1524104
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1524107
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1524116
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1525055
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1537353
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1545237
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1561213
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1561217
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1566260
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1566735
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1578659
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1579481
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1579544
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1590993
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1590994
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1594627
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1601628
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1632490
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1635045
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1646555
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1649094
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1649101
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1652637
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1656187
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1656195
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1660423
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1660424
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1660425
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1660426
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1664361
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2101.json