Bug 628264 (CVE-2017-12955)

Summary:	<media-gfx/exiv2-0.26_p20171104: out-of-bounds write results in denial of service (CVE-2017-12955)
Product:	Gentoo Security	Reporter:	Aleksandr Wagner (Kivak) <alwag>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	graphics+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://github.com/Exiv2/exiv2/issues/58
Whiteboard:	B3 [noglsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	632231
Bug Blocks:

Description Aleksandr Wagner (Kivak) 2017-08-19 07:26:41 UTC

CVE-2017-12955 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12955):

There is a heap-based buffer overflow in basicio.cpp of Exiv2 0.26. The vulnerability causes an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact. 

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1482295

Comment 1 Andreas Sturmlechner gentoo-dev

2017-10-23 23:38:42 UTC

Current snapshot media-gfx/exiv2-0.26_p20171018 should be unaffected.

Comment 2 Andreas Sturmlechner gentoo-dev

2017-11-19 15:32:34 UTC

Cleanup done in git commit cdb23e8b3608be50daebdeb5d904b179a58d8339