Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 659038 (CVE-2018-12648) - <media-libs/exempi-2.4.5-r1: NULL pointer dereference may cause denial of service (CVE-2018-12648)
Summary: <media-libs/exempi-2.4.5-r1: NULL pointer dereference may cause denial of ser...
Status: RESOLVED FIXED
Alias: CVE-2018-12648
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL: https://gitlab.freedesktop.org/libope...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2018-06-25 06:34 UTC by Florian Schuhmacher
Modified: 2018-12-04 23:14 UTC (History)
1 user (show)

See Also:
Package list:
media-libs/exempi-2.4.5-r1
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Schuhmacher 2018-06-25 06:34:05 UTC 
Exempi through version 2.4.5 is vulnerable to a NULL pointer dereference in the WEBP_Support.hpp:WEBP::GetLE32() function. An attacker could exploit this to cause a denial of service via a crafted file.

Gentoo Security Scout
Florian Schuhmacher
Comment 1 Larry the Git Cow gentoo-dev 2018-09-30 16:48:43 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=73a84757832eef175ea2b082378277d546c8accc

commit 73a84757832eef175ea2b082378277d546c8accc
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2018-09-30 16:46:58 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2018-09-30 16:46:58 +0000

    media-libs/exempi: Fix CVE-2018-12648
    
    Bug: https://bugs.gentoo.org/659038
    Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>
    Package-Manager: Portage-2.3.50, Repoman-2.3.11

 media-libs/exempi/exempi-2.4.5-r1.ebuild           | 58 ++++++++++++++++++++++
 .../exempi/files/exempi-2.4.5-CVE-2018-12648.patch | 42 ++++++++++++++++
 2 files changed, 100 insertions(+)
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2018-10-01 21:48:11 UTC 
x86 stable
Comment 3 Tobias Klausmann (RETIRED) gentoo-dev 2018-10-02 14:04:03 UTC 
Stable on alpha.
Comment 4 Rolf Eike Beer archtester 2018-10-04 21:07:48 UTC 
sparc done.
Comment 5 Agostino Sarubbo gentoo-dev 2018-10-05 13:44:03 UTC 
amd64 stable
Comment 6 Matt Turner gentoo-dev 2018-10-06 16:17:23 UTC 
ppc/ppc64 stable
Comment 7 Andreas Sturmlechner gentoo-dev 2018-10-06 20:43:39 UTC 
No arm, hppa, ia64 revdeps, removing from stable list.
Comment 8 Larry the Git Cow gentoo-dev 2018-10-06 20:45:15 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5b7205c0084397703a7865bd397d64243347403b

commit 5b7205c0084397703a7865bd397d64243347403b
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2018-10-06 19:47:32 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2018-10-06 20:45:02 +0000

    media-libs/exempi: Security cleanup
    
    Bug: https://bugs.gentoo.org/659038
    Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>
    Package-Manager: Portage-2.3.50, Repoman-2.3.11

 media-libs/exempi/exempi-2.4.5.ebuild | 52 -----------------------------------
 1 file changed, 52 deletions(-)