SUSE-SU-2022:3598-1

Dashboard / Vulnerabilities / SUSE-SU-2022:3598-1

SUSE-SU-2022:3598-1

Summary: Security update for exiv2

Details: This update for exiv2 fixes the following issues: - CVE-2021-37621: Fixed denial of service due to infinite loop in Image:printIFDStructure (bsc#1189333). - CVE-2021-37620: Fixed out-of-bounds read in XmpTextValue:read() (bsc#1189332). - CVE-2021-37619: Fixed out-of-bounds read in Exiv2:Jp2Image:encodeJp2Header (bsc#1189331). - CVE-2021-37618: Fixed out-of-bounds read in Exiv2:Jp2Image:printStructure (bsc#1189330). - CVE-2021-32617: Fixed denial of service inside inefficient algorithm (quadratic complexity) (bsc#1186192). - CVE-2021-31292: Fixed integer overflow in CrwMap:encode0x1810 (bsc#1188756). - CVE-2021-31291: Fixed heap-based buffer overflow vulnerability in jp2image.cpp may lead to a denial of service (bsc#1188733). - CVE-2021-29470: Fixed out-of-bounds read in Exiv2:Jp2Image:encodeJp2Header (bsc#1185447). - CVE-2020-18899: Fixed uncontrolled memory allocation (bsc#1189636). - CVE-2020-18898: Fixed remote denial of service in printIFDStructure function (bsc#1189780). - CVE-2018-8977: Fixed remote denial of service in Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp (bsc#1086798). - CVE-2018-8976: Fixed remote denial of service in image.cpp Exiv2::Internal::stringFormat via out-of-bounds read (bsc#1086810). - CVE-2018-5772: Fixed segmentation fault caused by uncontrolled recursion inthe Exiv2::Image::printIFDStructure (bsc#1076579). - CVE-2018-18915: Fixed an infinite loop in the Exiv2:Image:printIFDStructure function (bsc#1114690). - CVE-2018-10772: Fixed segmentation fault when the function Exiv2::tEXtToDataBuf() is finished (bsc#1092096).

References: https://www.suse.com/support/update/announcement/2022/suse-su-20223598-1/, https://bugzilla.suse.com/1076579, https://bugzilla.suse.com/1086798, https://bugzilla.suse.com/1086810, https://bugzilla.suse.com/1092096, https://bugzilla.suse.com/1114690, https://bugzilla.suse.com/1185447, https://bugzilla.suse.com/1186192, https://bugzilla.suse.com/1188733, https://bugzilla.suse.com/1188756, https://bugzilla.suse.com/1189330, https://bugzilla.suse.com/1189331, https://bugzilla.suse.com/1189332, https://bugzilla.suse.com/1189333, https://bugzilla.suse.com/1189636, https://bugzilla.suse.com/1189780, https://www.suse.com/security/cve/CVE-2018-10772, https://www.suse.com/security/cve/CVE-2018-18915, https://www.suse.com/security/cve/CVE-2018-5772, https://www.suse.com/security/cve/CVE-2018-8976, https://www.suse.com/security/cve/CVE-2018-8977, https://www.suse.com/security/cve/CVE-2020-18898, https://www.suse.com/security/cve/CVE-2020-18899, https://www.suse.com/security/cve/CVE-2021-29470, https://www.suse.com/security/cve/CVE-2021-31291, https://www.suse.com/security/cve/CVE-2021-31292, https://www.suse.com/security/cve/CVE-2021-32617, https://www.suse.com/security/cve/CVE-2021-37618, https://www.suse.com/security/cve/CVE-2021-37619, https://www.suse.com/security/cve/CVE-2021-37620, https://www.suse.com/security/cve/CVE-2021-37621