UbuntuUpdates.org

Package "exiv2"

Name: exiv2

Description:

EXIF/IPTC/XMP metadata manipulation tool

Latest version: 0.25-4ubuntu1.2
Release: disco (19.04)
Level: security
Repository: universe
Homepage: http://www.exiv2.org

Links

Save this URL for the latest version of "exiv2": https://www.ubuntuupdates.org/exiv2


Download "exiv2"


Other versions of "exiv2" in Disco

Repository Area Version
base main 0.25-4ubuntu1
base universe 0.25-4ubuntu1
security main 0.25-4ubuntu1.2
updates main 0.25-4ubuntu1.2
updates universe 0.25-4ubuntu1.2

Changelog

Version: 0.25-4ubuntu1.2 2019-10-21 16:07:08 UTC

  exiv2 (0.25-4ubuntu1.2) disco-security; urgency=medium

   * SECURITY UPDATE: Denial of service
     - debian/patches/CVE-2019-17402.patch: check offset and size
       against total size in src/crwimage.cpp.
     - CVE-2019-17402

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 17 Oct 2019 08:42:27 -0300

Source diff to previous version
CVE-2019-17402 Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in cr

Version: 0.25-4ubuntu1.1 2019-07-15 15:07:13 UTC

  exiv2 (0.25-4ubuntu1.1) disco-security; urgency=medium

   * SECURITY UPDATE: Integer overflow
     - debian/patches/CVE-2018-19107-19108-*.patch: add port of enforce()
       in src/enforce.hpp, use safe:add for preventing overflows in
       PSD files and enforce length of image resource
       section < file size in src/psdimage.cpp.
     - CVE-2018-19107
     - CVE-2018-19108
   * SECURITY UPDATE: Denial of service
     - debian/patches/CVE-2018-19535-*.patch: fixes in
       PngChunk::readRawProfile in src/pngchunk.cpp.
     - CVE-2018-19535
   * SECURITY UPDATE: Denial of service
     - debian/patches/CVE-2019-13110.patch: avoid integer overflow
       in src/crwimage.cpp.
     - CVE-2019-13110
   * SECURITY UPDATE: Denial of service
     - debian/patches/CVE-2019-13112.patch: add bound check
       on allocation size in src/pngchunk.cpp.
     - CVE-2019-13112
   * SECURITY UPDATE: Denial of service
     - debian/patches/CVE-2019-13113.patch: throw an exception
       if the data location is invalid in src/crwimage.cpp,
       src/crwimage_int.hpp.
     - CVE-2019-13113
   * SECURITY UPDATE: Denial of service
     - debian/patches/CVE-2019-13114.patch: avoid null pointer
       exception due to NULL return from strchr in src/http.cpp.
     - CVE-2019-13114
   * Add error codes from src error in order to support CVE-2018-19535
     - debian/patches/0001-Added-error-codes-from-src-error.cpp-into-an-enumera.patch

 -- <email address hidden> (Leonidas S. Barbosa) Wed, 10 Jul 2019 15:20:16 -0300

CVE-2018-19107 In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-bas
CVE-2018-19108 In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an
CVE-2018-19535 In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-base
CVE-2019-13110 A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSE
CVE-2019-13112 A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an
CVE-2019-13113 Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image fil
CVE-2019-13114 http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a c



About   -   Send Feedback to @ubuntu_updates