Multiple vulnerabilities have been found in Exiv2, library and a command line utility to read and write Exif, IPTC and XMP image metadata. CVE-2018-10998 An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call. Apparently denied as a security issue upstream, see https://github.com/Exiv2/exiv2/issues/303 CVE-2018-10999 An issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has a heap-based buffer over-read. See https://github.com/Exiv2/exiv2/issues/306 CVE-2018-11531 Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. See https://github.com/Exiv2/exiv2/issues/283 CVE-2018-12264 Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp. See https://github.com/Exiv2/exiv2/issues/366 CVE-2018-12265 Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp. See https://github.com/Exiv2/exiv2/issues/365 The following is linked to Red Hat's bugzilla by Mitre, where the issue is marked NOTABUG, but I haven't been able to find any upstream reference, so it might be bogus. Documenting here for completeness. CVE-2018-10780 Exiv2::Image::byteSwap2 in image.cpp in Exiv2 0.26 has a heap-based buffer over-read. See https://bugzilla.redhat.com/show_bug.cgi?id=1575201 -- Gentoo Security Scout Vladimir Krstulja
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f33aacc28aa4a62c2123dbbecfbdb911dd4ba470 commit f33aacc28aa4a62c2123dbbecfbdb911dd4ba470 Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2018-09-18 20:45:33 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2018-09-18 20:53:50 +0000 media-gfx/exiv2: Add 0.26_p20180811 snapshot Custom packed tarball based on upstream 0.26 branch as of 2018-08-11, fixing CVE-2018-12264, CVE-2018-12265, with downstream updated config.{guess,sub} and fixed CVE-2017-17723. Bug: https://bugs.gentoo.org/647812 Bug: https://bugs.gentoo.org/658236 Closes: https://bugs.gentoo.org/663870 Package-Manager: Portage-2.3.49, Repoman-2.3.10 media-gfx/exiv2/Manifest | 1 + media-gfx/exiv2/exiv2-0.26_p20180811.ebuild | 123 ++++++++++++++++++++++++++++ 2 files changed, 124 insertions(+)
CVE-2018-10998 was closed notabug in https://github.com/Exiv2/exiv2/commit/f4e8ed2fd48d012467b99552f0d6378302a23c75, the commit adding the exception is in media-gfx/exiv2-0.26_p20180811.
CVE-2018-10780 was declared fixed in https://github.com/Exiv2/exiv2/issues/229, the relevant commit is part of media-gfx/exiv2-0.26_p20180811.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b6355d89b9bd7b657c3ad5680f899b6de75de1a7 commit b6355d89b9bd7b657c3ad5680f899b6de75de1a7 Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2018-09-21 10:12:50 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2018-09-21 10:20:37 +0000 media-gfx/exiv2: Tarball respun for CVE-2018-10999, CVE-2018-11531 Custom packed tarball based on upstream 0.26 branch as of 2018-08-11, with additional fixes from git master. Bug: https://bugs.gentoo.org/658236 Package-Manager: Portage-2.3.49, Repoman-2.3.10 media-gfx/exiv2/Manifest | 1 + media-gfx/exiv2/exiv2-0.26_p20180811-r1.ebuild | 123 +++++++++++++++++++++++++ 2 files changed, 124 insertions(+)
sparc done.
ia64 stable
amd64 stable
x86 stable
Stable on alpha.
ppc/ppc64 stable
arm stable, all arches done.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8c24aae658082194548daf5a845dc996fab7f9f0 commit 8c24aae658082194548daf5a845dc996fab7f9f0 Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2018-10-29 10:06:45 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2018-10-29 10:14:24 +0000 media-gfx/exiv2: Security cleanup Bug: https://bugs.gentoo.org/658236 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> Package-Manager: Portage-2.3.50, Repoman-2.3.11 media-gfx/exiv2/Manifest | 1 - media-gfx/exiv2/exiv2-0.26_p20180319.ebuild | 136 ------ .../exiv2-0.26_p20180319-CVE-2017-18005.patch | 484 --------------------- .../files/exiv2-0.26_p20180319-CVE-2018-4868.patch | 39 -- .../files/exiv2-0.26_p20180319-clang-fix.patch | 47 -- 5 files changed, 707 deletions(-)
Cleanup done, can we please make progress here (and in all depending bugs)?
KDE is done here, anyway...
Reclassifying B3 (should of been) GLSA Vote: Yes New GLSA Request filed.
This issue was resolved and addressed in GLSA 201811-14 at https://security.gentoo.org/glsa/201811-14 by GLSA coordinator Aaron Bauman (b-man).
