This update for exiv2 to 0.26 fixes the following security issues :

  - CVE-2017-14864: Prevent invalid memory address     dereference in Exiv2::getULong that could have caused a     segmentation fault and application crash, which leads to     denial of service (bsc#1060995).

  - CVE-2017-14862: Prevent invalid memory address     dereference in Exiv2::DataValue::read that could have     caused a segmentation fault and application crash, which     leads to denial of service (bsc#1060996).

  - CVE-2017-14859: Prevent invalid memory address     dereference in Exiv2::StringValueBase::read that could     have caused a segmentation fault and application crash,     which leads to denial of service (bsc#1061000).

  - CVE-2017-14860: Prevent heap-based buffer over-read in     the Exiv2::Jp2Image::readMetadata function via a crafted     input that could have lead to a denial of service attack     (bsc#1061023).

  - CVE-2017-11337: Prevent invalid free in the     Action::TaskFactory::cleanup function via a crafted     input that could have lead to a remote denial of service     attack (bsc#1048883).

  - CVE-2017-11338: Prevent infinite loop in the     Exiv2::Image::printIFDStructure function via a crafted     input that could have lead to a remote denial of service     attack (bsc#1048883).

  - CVE-2017-11339: Prevent heap-based buffer overflow in     the Image::printIFDStructure function via a crafted     input that could have lead to a remote denial of service     attack (bsc#1048883).

  - CVE-2017-11340: Prevent Segmentation fault in the     XmpParser::terminate() function via a crafted input that     could have lead to a remote denial of service attack     (bsc#1048883).

  - CVE-2017-12955: Prevent heap-based buffer overflow. The     vulnerability caused an out-of-bounds write in     Exiv2::Image::printIFDStructure(), which may lead to     remote denial of service or possibly unspecified other     impact (bsc#1054593).

  - CVE-2017-12956: Preventn illegal address access in     Exiv2::FileIo::path[abi:cxx11]() that could have lead to     remote denial of service (bsc#1054592).

  - CVE-2017-12957: Prevent heap-based buffer over-read that     was triggered in the Exiv2::Image::io function and could     have lead to remote denial of service (bsc#1054590).

  - CVE-2017-11683: Prevent reachable assertion in the     Internal::TiffReader::visitDirectory function that could     have lead to a remote denial of service attack via     crafted input (bsc#1051188).

  - CVE-2017-11591: Prevent Floating point exception in the     Exiv2::ValueType function that could have lead to a     remote denial of service attack via crafted input     (bsc#1050257).

  - CVE-2017-11553: Prevent illegal address access in the     extend_alias_table function via a crafted input could     have lead to remote denial of service.

  - CVE-2017-11592: Prevent mismatched Memory Management     Routines vulnerability in the Exiv2::FileIo::seek     function that could have lead to a remote denial of     service attack (heap memory corruption) via crafted     input.

This update was imported from the SUSE:SLE-15:Update update project.

Detections

Analytics

openSUSE Security Update : exiv2 (openSUSE-2019-504)

high Nessus Plugin ID 123209

Version 1.5