Bug 791397 – <media-libs/exiftool-12.26: Vulnerability in lang option

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2021-05-22 05:02:00 UTC]

"May 20, 2021 - Version 12.26 (production release)
Added support for JPEG Stereo (JPS) images
Added a new Sony LensType (thanks LibRaw)
Added a new PentaxModelID (thanks LibRaw)
Changed ExifTool namespace URI to use exiftool.org instead of exiftool.ca in the -X option output (exiftool.ca is still recognized when reading XML)
Improved handling of large-array warnings in -htmldump output
Changed handling of escaped characters in #[CSTR] lines of -@ argfile
Patched security vulnerability in argument of -lang option
Fixed problem which could cause a "Wide character" warning and generate a corrupted output file when writing some illegal values"

[Comment 1 Sam James 2021-05-22 05:04:16 UTC]

I assume this is the related hunk: https://github.com/exiftool/exiftool/commit/bd14871e8a3bc2b15ea2e3d5dd22bec4f50a6a40#diff-0afd0dd17de0020506564721e0651d8b1534d063583023fb241fc7f9f34ffd02R2088

[Comment 2 Agostino Sarubbo 2021-05-27 06:56:01 UTC]

amd64 stable

[Comment 3 Agostino Sarubbo 2021-05-27 06:57:43 UTC]

x86 stable

[Comment 4 Sam James 2021-05-27 19:10:47 UTC]

arm64 done

[Comment 5 Sam James 2021-05-27 19:20:22 UTC]

ppc64 done

[Comment 6 Sam James 2021-05-27 19:22:32 UTC]

ppc done

all arches done

[Comment 7 Larry the Git Cow 2021-05-30 21:01:15 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5b20f7125508f3a30f11bbb08f89ee86ad68d28e

commit 5b20f7125508f3a30f11bbb08f89ee86ad68d28e
Author:     Andreas K. Hüttel <[e-mail]>
AuthorDate: 2021-05-30 20:34:41 +0000
Commit:     Andreas K. Hüttel <[e-mail]>
CommitDate: 2021-05-30 21:00:51 +0000

    media-libs/exiftool: Remove old
    
    Bug: https://bugs.gentoo.org/791397
    Package-Manager: Portage-3.0.18, Repoman-3.0.2
    Signed-off-by: Andreas K. Hüttel <[e-mail]>

 media-libs/exiftool/Manifest                       |  1 -
 media-libs/exiftool/exiftool-12.16-r1.ebuild       | 27 -------------------
 .../files/exiftool-12.16-CVE-2021-22204.patch      | 30 ----------------------
 3 files changed, 58 deletions(-)

[Comment 8 NATTkA bot 2021-10-23 15:40:48 UTC]

Unable to check for sanity:

> no match for package: media-libs/exiftool-12.26

[Comment 9 Andreas K. Hüttel 2021-10-31 20:10:43 UTC]

cleanup done

[Comment 10 Larry the Git Cow 2024-07-24 06:08:46 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=cbb2c6bdcf7c6bcf9d999c22c28ef4eb416b0a51

commit cbb2c6bdcf7c6bcf9d999c22c28ef4eb416b0a51
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-07-24 06:08:31 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-07-24 06:08:44 +0000

    [ GLSA 202407-27 ] ExifTool: Multiple vulnerabilities
    
    Bug: https://bugs.gentoo.org/785667
    Bug: https://bugs.gentoo.org/791397
    Bug: https://bugs.gentoo.org/803317
    Bug: https://bugs.gentoo.org/832033
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202407-27.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)