SUSE SLED15 / SLES15 / openSUSE 15 Security Update : exiv2 (SUSE-SU-2022:3889-1)

high Nessus Plugin ID 167062

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3889-1 advisory.

- Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser (CVE-2017-1000128)

- An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset.
(CVE-2019-13108)

- A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.
(CVE-2019-13111)

- A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS). (CVE-2020-19716)

- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4. (CVE-2021-29457)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 167062

File Name: suse_SU-2022-3889-1.nasl

Version: 1.9

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/8/2022

Updated: 11/9/2023

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-29457

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:libexiv2-devel, p-cpe:/a:novell:suse_linux:libexiv2-xmp-static, p-cpe:/a:novell:suse_linux:libexiv2-26, cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:libexiv2-27

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/7/2022

Vulnerability Publication Date: 11/17/2017

Reference Information

CVE: CVE-2017-1000128, CVE-2019-13108, CVE-2019-13111, CVE-2020-19716, CVE-2021-29457, CVE-2021-29463, CVE-2021-29470, CVE-2021-29623, CVE-2021-31291, CVE-2021-32617, CVE-2021-34334, CVE-2021-37620, CVE-2021-37621, CVE-2021-37622, CVE-2021-37623

SuSE: SUSE-SU-2022:3889-1

Detections

Analytics