SUSE-SU-2022:4208-1

Dashboard / Vulnerabilities / SUSE-SU-2022:4208-1

SUSE-SU-2022:4208-1

Summary: Security update for exiv2-0_26

Details: This update for exiv2-0_26 fixes the following issues: - CVE-2019-17402: Fixed improper validation of the total size to the offset and size leads to a crash in Exiv2::getULong in types.cpp (bsc#1153577). - CVE-2018-20098: Fixed a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header (bsc#1119560). - CVE-2018-17581: Fixed an excessive stack consumption CiffDirectory:readDirectory() at crwimage_int.cpp (bsc#1110282). - CVE-2018-20099: exiv2: infinite loop in Exiv2::Jp2Image::encodeJp2Header (bsc#1119559). - CVE-2018-20097: Fixed SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroupsu (bsc#1119562). - CVE-2017-11591: Fixed a floating point exception in Exiv2::ValueType (bsc#1050257). - CVE-2018-11531: Fixed a heap-based buffer overflow in getData in preview.cpp (bsc#1095070). - CVE-2021-32815: Fixed a deny-of-service due to assertion failure in crwimage_int.cpp (bsc#1189337). - CVE-2021-29473: Fixed out-of-bounds read in Exiv2::Jp2Image:doWriteMetadata (bsc#1186231). - CVE-2019-13109: Fixed a denial of service in PngImage:readMetadata (bsc#1142677). - CVE-2019-13110: Fixed an integer-overflow and out-of-bounds read in CiffDirectory:readDirectory leads to denail of service (bsc#1142678).

References: https://www.suse.com/support/update/announcement/2022/suse-su-20224208-1/, https://bugzilla.suse.com/1050257, https://bugzilla.suse.com/1095070, https://bugzilla.suse.com/1110282, https://bugzilla.suse.com/1119559, https://bugzilla.suse.com/1119560, https://bugzilla.suse.com/1119562, https://bugzilla.suse.com/1142677, https://bugzilla.suse.com/1142678, https://bugzilla.suse.com/1153577, https://bugzilla.suse.com/1186231, https://bugzilla.suse.com/1189337, https://www.suse.com/security/cve/CVE-2017-11591, https://www.suse.com/security/cve/CVE-2018-11531, https://www.suse.com/security/cve/CVE-2018-17581, https://www.suse.com/security/cve/CVE-2018-20097, https://www.suse.com/security/cve/CVE-2018-20098, https://www.suse.com/security/cve/CVE-2018-20099, https://www.suse.com/security/cve/CVE-2019-13109, https://www.suse.com/security/cve/CVE-2019-13110, https://www.suse.com/security/cve/CVE-2019-17402, https://www.suse.com/security/cve/CVE-2021-29473, https://www.suse.com/security/cve/CVE-2021-32815