An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FormatSupport/WEBP_Support.cpp does not check whether a bitstream has a NULL value, leading to a NULL pointer dereference in the WEBP::VP8XChunk class.

Update to latest upstream release 0.3.15 (#1885156)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Version **2.4.5** fixes the following security issues :

  - **CVE-2018-7728**

  - **CVE-2018-7729**

  - **CVE-2018-7730**

  - **CVE-2018-7731**

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3668-1 advisory.

    It was discovered that Exempi incorrectly handled certain media files. If a user or automated system were     tricked into opening a specially crafted file, a remote attacker could cause Exempi to hang or crash,     resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Version **2.4.5** fixes the following security issues :

  - **CVE-2018-7728**

  - **CVE-2018-7729**

  - **CVE-2018-7730**

  - **CVE-2018-7731**

Version **2.4.4** fixes the following security issues :

  - **CVE-2017-18233**

  - **CVE-2017-18236**

Version **2.4.3** fixes the following security issues :

  - **CVE-2017-18234**

  - **CVE-2017-18235**

  - **CVE-2017-18237**

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
141906	Fedora 33 : python-msldap (2020-e22e9a655d)	Nessus	Fedora Local Security Checks	medium
120271	Fedora 28 : exempi (2018-1c9f6768cf)	Nessus	Fedora Local Security Checks	medium
110321	Ubuntu 14.04 LTS / 16.04 LTS : Exempi vulnerabilities (USN-3668-1)	Nessus	Ubuntu Local Security Checks	high
108839	Fedora 27 : exempi (2018-c442aad4dc)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-7731

medium

Tenable Plugins

medium

medium

high

high