Bug 635220 (CVE-2017-11591, CVE-2017-11592)

Summary:	<media-gfx/exiv2-0.26_p20171104: Multiple vulnerabilities
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	graphics+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/Exiv2/exiv2/issues/54
Whiteboard:	B3 [noglsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	632231
Bug Blocks:

Description GLSAMaker/CVETool Bot gentoo-dev

2017-10-23 20:10:21 UTC

CVE-2017-14857 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-14857):
  In Exiv2 0.26, there is an invalid free in the Image class in image.cpp that
  leads to a Segmentation fault. A crafted input will lead to a denial of
  service attack.

CVE-2017-11592 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-11592):
  There is a Mismatched Memory Management Routines vulnerability in the
  Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial
  of service attack (heap memory corruption) via crafted input.

CVE-2017-11591 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-11591):
  There is a Floating point exception in the Exiv2::ValueType function in
  Exiv2 0.26 that will lead to a remote denial of service attack via crafted
  input.

Comment 1 D'juan McDonald (domhnall) 2017-10-23 21:00:55 UTC

CVE-2017-14857 Patch:
(https://github.com/Exiv2/exiv2/commit/74cb5bab132ed76adf15df172c5e8b58cddaa96c)

CVE-2017-11592 Patch:
(https://github.com/Exiv2/exiv2/commit/6e3855aed7ba8bb4731fc4087ca7f9078b2f3d97)

CVE-2017-11591 Patch:
(https://github.com/Exiv2/exiv2/commit/8a8f60a4e7089fe7bb597770a2daab24a3941d3e)

@maintainer(s), after bump, please call for stabilization, Thank you.

Gentoo Security Padawan
Daj Uan (jmbailey)

Comment 2 Andreas Sturmlechner gentoo-dev

2017-10-23 23:37:50 UTC

Current snapshot media-gfx/exiv2-0.26_p20171018 should be unaffected.

Comment 3 Andreas Sturmlechner gentoo-dev

2017-11-19 15:32:45 UTC

Cleanup done in git commit cdb23e8b3608be50daebdeb5d904b179a58d8339