MGASA-2017-0391

Dashboard / Vulnerabilities / MGASA-2017-0391

MGASA-2017-0391

Summary: Updated exiv2 packages fix security vulnerabilities & bugs

Details: Opening an image created on certain pentax cameras with gwenview, which uses the exiv2 library, causes gwenview to segfault. Exiv2 upstream created a patch to resolve this problem (bugfix - applies only to mga6). The following security issues were also fixed: *Heap overflow in Exiv2::Image::printIFDStructure (CVE-2017-11336) *Invalid free in the Action::TaskFactory::cleanup function (CVE-2017-11337) *Infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp (CVE-2017-11338) *Heap-based buffer overflow in the Image::printIFDStructure function of image.cpp (CVE-2017-11339) *Segmentation fault in the XmpParser::terminate() function (CVE-2017-11340) *Illegal address access in the extend_alias_table function in localealias.c (CVE-2017-11553) *Floating point exception in the Exiv2::ValueType function (CVE-2017-11591) *Alloc-dealloc-mismatch in Exiv2::FileIo::seek (CVE-2017-11592) *Reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp (CVE-2017-11683) *Heap-based buffer overflow in basicio.cpp (CVE-2017-12955) *Illegal address access in Exiv2::FileIo::path[abi:cxx11]() in basicio.cpp (CVE-2017-12956) *Heap-based buffer over-read in the Exiv2::Image::io function in image.cpp (CVE-2017-12957) *Bad free in Exiv2::Image::~Image (CVE-2017-14857) *Invalid memory address dereference in Exiv2::DataValue::read (CVE-2017-14859) *Heap-buffer-overflow in Exiv2::Jp2Image::readMetadata (CVE-2017-14860) *Invalid memory address dereference in Exiv2::StringValueBase::read (CVE-2017-14862) *Invalid memory address dereference in Exiv2::getULong (CVE-2017-14864)

References: https://advisories.mageia.org/MGASA-2017-0391.html, https://bugs.mageia.org/show_bug.cgi?id=21158, https://bugs.mageia.org/show_bug.cgi?id=21922, http://openwall.com/lists/oss-security/2017/06/30/1