Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2017-1000126 (GCVE-0-2017-1000126)
Vulnerability from cvelistv5
Published
2017-11-17 22:00
Modified
2024-08-05 21:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
exiv2 0.26 contains a Stack out of bounds read in webp parser
References
► | URL | Tags | |||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T21:53:06.799Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "[oss-security] 20170630 exiv2: multiple memory safety issues", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" }, { "name": "openSUSE-SU-2020:0482", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "dateAssigned": "2017-08-22T00:00:00", "datePublic": "2017-06-30T00:00:00", "descriptions": [ { "lang": "en", "value": "exiv2 0.26 contains a Stack out of bounds read in webp parser" } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-04-08T23:06:07", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "[oss-security] 20170630 exiv2: multiple memory safety issues", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" }, { "name": "openSUSE-SU-2020:0482", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "DATE_ASSIGNED": "2017-08-22T17:29:33.340007", "ID": "CVE-2017-1000126", "REQUESTER": "hanno@hboeck.de", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "exiv2 0.26 contains a Stack out of bounds read in webp parser" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "[oss-security] 20170630 exiv2: multiple memory safety issues", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" }, { "name": "openSUSE-SU-2020:0482", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-1000126", "datePublished": "2017-11-17T22:00:00", "dateReserved": "2017-11-17T00:00:00", "dateUpdated": "2024-08-05T21:53:06.799Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2017-1000126\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-11-17T22:29:00.220\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"exiv2 0.26 contains a Stack out of bounds read in webp parser\"},{\"lang\":\"es\",\"value\":\"exiv2 0.26 contiene una vulnerabilidad de lectura de pila fuera de l\u00edmites en el analizador webp.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exiv2:exiv2:0.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D46E025A-62BF-4024-BB8D-D8C2FFE1D213\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2017/06/30/1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2017/06/30/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\",\"VDB Entry\"]}]}}" } }
opensuse-su-2020:0482-1
Vulnerability from csaf_opensuse
Published
2020-04-08 18:18
Modified
2020-04-08 18:18
Summary
Security update for exiv2
Notes
Title of the patch
Security update for exiv2
Description of the patch
This update for exiv2 fixes the following issues:
exiv2 was updated to latest 0.26 branch, fixing bugs and security issues:
- CVE-2017-1000126: Fixed an out of bounds read in webp parser (bsc#1068873).
- CVE-2017-9239: Fixed a segmentation fault in TiffImageEntry::doWriteImage function (bsc#1040973).
- CVE-2018-12264: Fixed an integer overflow in LoaderTiff::getData() which
might have led to an out-of-bounds read (bsc#1097600).
- CVE-2018-12265: Fixed integer overflows in LoaderExifJpeg which could have
led to memory corruption (bsc#1097599).
- CVE-2018-17229: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109175).
- CVE-2018-17230: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109176).
- CVE-2018-17282: Fixed a null pointer dereference in Exiv2::DataValue::copy (bsc#1109299).
- CVE-2018-19108: Fixed an integer overflow in Exiv2::PsdImage::readMetadata which could have
led to infinite loop (bsc#1115364).
- CVE-2018-19607: Fixed a null pointer dereference in Exiv2::isoSpeed which might have led to denial
of service (bsc#1117513).
- CVE-2018-9305: Fixed an out of bounds read in IptcData::printStructure which might have led to
to information leak or denial of service (bsc#1088424).
- CVE-2019-13114: Fixed a null pointer dereference which might have led to denial of service via
a crafted response of an malicious http server (bsc#1142684).
This update was imported from the SUSE:SLE-15:Update update project.
Patchnames
openSUSE-2020-482
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for exiv2", "title": "Title of the patch" }, { "category": "description", "text": "This update for exiv2 fixes the following issues:\n\nexiv2 was updated to latest 0.26 branch, fixing bugs and security issues:\n\n- CVE-2017-1000126: Fixed an out of bounds read in webp parser (bsc#1068873).\n- CVE-2017-9239: Fixed a segmentation fault in TiffImageEntry::doWriteImage function (bsc#1040973).\n- CVE-2018-12264: Fixed an integer overflow in LoaderTiff::getData() which\n might have led to an out-of-bounds read (bsc#1097600).\n- CVE-2018-12265: Fixed integer overflows in LoaderExifJpeg which could have \n led to memory corruption (bsc#1097599).\n- CVE-2018-17229: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109175).\n- CVE-2018-17230: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109176).\n- CVE-2018-17282: Fixed a null pointer dereference in Exiv2::DataValue::copy (bsc#1109299).\n- CVE-2018-19108: Fixed an integer overflow in Exiv2::PsdImage::readMetadata which could have \n led to infinite loop (bsc#1115364).\n- CVE-2018-19607: Fixed a null pointer dereference in Exiv2::isoSpeed which might have led to denial \n of service (bsc#1117513).\n- CVE-2018-9305: Fixed an out of bounds read in IptcData::printStructure which might have led to \n to information leak or denial of service (bsc#1088424).\n- CVE-2019-13114: Fixed a null pointer dereference which might have led to denial of service via \n a crafted response of an malicious http server (bsc#1142684).\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2020-482", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0482-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2020:0482-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U7X32HSPSOKHILGP4IPOOWMROAKSPGIY/" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2020:0482-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U7X32HSPSOKHILGP4IPOOWMROAKSPGIY/" }, { "category": "self", "summary": "SUSE Bug 1040973", "url": "https://bugzilla.suse.com/1040973" }, { "category": "self", "summary": "SUSE Bug 1068873", "url": "https://bugzilla.suse.com/1068873" }, { "category": "self", "summary": "SUSE Bug 1088424", "url": "https://bugzilla.suse.com/1088424" }, { "category": "self", "summary": "SUSE Bug 1097599", "url": "https://bugzilla.suse.com/1097599" }, { "category": "self", "summary": "SUSE Bug 1097600", "url": "https://bugzilla.suse.com/1097600" }, { "category": "self", "summary": "SUSE Bug 1109175", "url": "https://bugzilla.suse.com/1109175" }, { "category": "self", "summary": "SUSE Bug 1109176", "url": "https://bugzilla.suse.com/1109176" }, { "category": "self", "summary": "SUSE Bug 1109299", "url": "https://bugzilla.suse.com/1109299" }, { "category": "self", "summary": "SUSE Bug 1115364", "url": "https://bugzilla.suse.com/1115364" }, { "category": "self", "summary": "SUSE Bug 1117513", "url": "https://bugzilla.suse.com/1117513" }, { "category": "self", "summary": "SUSE Bug 1142684", "url": "https://bugzilla.suse.com/1142684" }, { "category": "self", "summary": "SUSE CVE CVE-2017-1000126 page", "url": "https://www.suse.com/security/cve/CVE-2017-1000126/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-9239 page", "url": "https://www.suse.com/security/cve/CVE-2017-9239/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-12264 page", "url": "https://www.suse.com/security/cve/CVE-2018-12264/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-12265 page", "url": "https://www.suse.com/security/cve/CVE-2018-12265/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17229 page", "url": "https://www.suse.com/security/cve/CVE-2018-17229/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17230 page", "url": "https://www.suse.com/security/cve/CVE-2018-17230/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17282 page", "url": "https://www.suse.com/security/cve/CVE-2018-17282/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-19108 page", "url": "https://www.suse.com/security/cve/CVE-2018-19108/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-19607 page", "url": "https://www.suse.com/security/cve/CVE-2018-19607/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-9305 page", "url": "https://www.suse.com/security/cve/CVE-2018-9305/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13114 page", "url": "https://www.suse.com/security/cve/CVE-2019-13114/" } ], "title": "Security update for exiv2", "tracking": { "current_release_date": "2020-04-08T18:18:55Z", "generator": { "date": "2020-04-08T18:18:55Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2020:0482-1", "initial_release_date": "2020-04-08T18:18:55Z", "revision_history": [ { "date": "2020-04-08T18:18:55Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "exiv2-0.26-lp151.7.3.1.i586", "product": { "name": "exiv2-0.26-lp151.7.3.1.i586", "product_id": "exiv2-0.26-lp151.7.3.1.i586" } }, { "category": "product_version", "name": "libexiv2-26-0.26-lp151.7.3.1.i586", "product": { "name": "libexiv2-26-0.26-lp151.7.3.1.i586", "product_id": "libexiv2-26-0.26-lp151.7.3.1.i586" } }, { "category": "product_version", "name": "libexiv2-devel-0.26-lp151.7.3.1.i586", "product": { "name": "libexiv2-devel-0.26-lp151.7.3.1.i586", "product_id": "libexiv2-devel-0.26-lp151.7.3.1.i586" } }, { "category": "product_version", "name": "libexiv2-doc-0.26-lp151.7.3.1.i586", "product": { "name": "libexiv2-doc-0.26-lp151.7.3.1.i586", "product_id": "libexiv2-doc-0.26-lp151.7.3.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "exiv2-lang-0.26-lp151.7.3.1.noarch", "product": { "name": "exiv2-lang-0.26-lp151.7.3.1.noarch", "product_id": "exiv2-lang-0.26-lp151.7.3.1.noarch" } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "exiv2-0.26-lp151.7.3.1.x86_64", "product": { "name": "exiv2-0.26-lp151.7.3.1.x86_64", "product_id": "exiv2-0.26-lp151.7.3.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-26-0.26-lp151.7.3.1.x86_64", "product": { "name": "libexiv2-26-0.26-lp151.7.3.1.x86_64", "product_id": "libexiv2-26-0.26-lp151.7.3.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "product": { "name": "libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "product_id": "libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-devel-0.26-lp151.7.3.1.x86_64", "product": { "name": "libexiv2-devel-0.26-lp151.7.3.1.x86_64", "product_id": "libexiv2-devel-0.26-lp151.7.3.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-doc-0.26-lp151.7.3.1.x86_64", "product": { "name": "libexiv2-doc-0.26-lp151.7.3.1.x86_64", "product_id": "libexiv2-doc-0.26-lp151.7.3.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Leap 15.1", "product": { "name": "openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1", "product_identification_helper": { "cpe": "cpe:/o:opensuse:leap:15.1" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "exiv2-0.26-lp151.7.3.1.i586 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586" }, "product_reference": "exiv2-0.26-lp151.7.3.1.i586", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "exiv2-0.26-lp151.7.3.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64" }, "product_reference": "exiv2-0.26-lp151.7.3.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "exiv2-lang-0.26-lp151.7.3.1.noarch as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch" }, "product_reference": "exiv2-lang-0.26-lp151.7.3.1.noarch", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-26-0.26-lp151.7.3.1.i586 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586" }, "product_reference": "libexiv2-26-0.26-lp151.7.3.1.i586", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-26-0.26-lp151.7.3.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64" }, "product_reference": "libexiv2-26-0.26-lp151.7.3.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64" }, "product_reference": "libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.26-lp151.7.3.1.i586 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586" }, "product_reference": "libexiv2-devel-0.26-lp151.7.3.1.i586", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.26-lp151.7.3.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64" }, "product_reference": "libexiv2-devel-0.26-lp151.7.3.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-doc-0.26-lp151.7.3.1.i586 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586" }, "product_reference": "libexiv2-doc-0.26-lp151.7.3.1.i586", "relates_to_product_reference": "openSUSE Leap 15.1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-doc-0.26-lp151.7.3.1.x86_64 as component of openSUSE Leap 15.1", "product_id": "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" }, "product_reference": "libexiv2-doc-0.26-lp151.7.3.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-1000126", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-1000126" } ], "notes": [ { "category": "general", "text": "exiv2 0.26 contains a Stack out of bounds read in webp parser", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-1000126", "url": "https://www.suse.com/security/cve/CVE-2017-1000126" }, { "category": "external", "summary": "SUSE Bug 1068873 for CVE-2017-1000126", "url": "https://bugzilla.suse.com/1068873" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "moderate" } ], "title": "CVE-2017-1000126" }, { "cve": "CVE-2017-9239", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-9239" } ], "notes": [ { "category": "general", "text": "An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-9239", "url": "https://www.suse.com/security/cve/CVE-2017-9239" }, { "category": "external", "summary": "SUSE Bug 1040973 for CVE-2017-9239", "url": "https://bugzilla.suse.com/1040973" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "low" } ], "title": "CVE-2017-9239" }, { "cve": "CVE-2018-12264", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-12264" } ], "notes": [ { "category": "general", "text": "Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-12264", "url": "https://www.suse.com/security/cve/CVE-2018-12264" }, { "category": "external", "summary": "SUSE Bug 1097600 for CVE-2018-12264", "url": "https://bugzilla.suse.com/1097600" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "low" } ], "title": "CVE-2018-12264" }, { "cve": "CVE-2018-12265", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-12265" } ], "notes": [ { "category": "general", "text": "Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-12265", "url": "https://www.suse.com/security/cve/CVE-2018-12265" }, { "category": "external", "summary": "SUSE Bug 1097599 for CVE-2018-12265", "url": "https://bugzilla.suse.com/1097599" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "low" } ], "title": "CVE-2018-12265" }, { "cve": "CVE-2018-17229", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-17229" } ], "notes": [ { "category": "general", "text": "Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-17229", "url": "https://www.suse.com/security/cve/CVE-2018-17229" }, { "category": "external", "summary": "SUSE Bug 1109175 for CVE-2018-17229", "url": "https://bugzilla.suse.com/1109175" }, { "category": "external", "summary": "SUSE Bug 1109176 for CVE-2018-17229", "url": "https://bugzilla.suse.com/1109176" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "low" } ], "title": "CVE-2018-17229" }, { "cve": "CVE-2018-17230", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-17230" } ], "notes": [ { "category": "general", "text": "Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-17230", "url": "https://www.suse.com/security/cve/CVE-2018-17230" }, { "category": "external", "summary": "SUSE Bug 1109176 for CVE-2018-17230", "url": "https://bugzilla.suse.com/1109176" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "moderate" } ], "title": "CVE-2018-17230" }, { "cve": "CVE-2018-17282", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-17282" } ], "notes": [ { "category": "general", "text": "An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-17282", "url": "https://www.suse.com/security/cve/CVE-2018-17282" }, { "category": "external", "summary": "SUSE Bug 1109299 for CVE-2018-17282", "url": "https://bugzilla.suse.com/1109299" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "low" } ], "title": "CVE-2018-17282" }, { "cve": "CVE-2018-19108", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-19108" } ], "notes": [ { "category": "general", "text": "In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-19108", "url": "https://www.suse.com/security/cve/CVE-2018-19108" }, { "category": "external", "summary": "SUSE Bug 1115364 for CVE-2018-19108", "url": "https://bugzilla.suse.com/1115364" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "low" } ], "title": "CVE-2018-19108" }, { "cve": "CVE-2018-19607", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-19607" } ], "notes": [ { "category": "general", "text": "Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-19607", "url": "https://www.suse.com/security/cve/CVE-2018-19607" }, { "category": "external", "summary": "SUSE Bug 1117513 for CVE-2018-19607", "url": "https://bugzilla.suse.com/1117513" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "low" } ], "title": "CVE-2018-19607" }, { "cve": "CVE-2018-9305", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-9305" } ], "notes": [ { "category": "general", "text": "In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the \"== 0x1c\" case.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-9305", "url": "https://www.suse.com/security/cve/CVE-2018-9305" }, { "category": "external", "summary": "SUSE Bug 1088424 for CVE-2018-9305", "url": "https://bugzilla.suse.com/1088424" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "low" } ], "title": "CVE-2018-9305" }, { "cve": "CVE-2019-13114", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-13114" } ], "notes": [ { "category": "general", "text": "http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-13114", "url": "https://www.suse.com/security/cve/CVE-2019-13114" }, { "category": "external", "summary": "SUSE Bug 1142684 for CVE-2019-13114", "url": "https://bugzilla.suse.com/1142684" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:exiv2-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:exiv2-lang-0.26-lp151.7.3.1.noarch", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-26-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-26-32bit-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-devel-0.26-lp151.7.3.1.x86_64", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.i586", "openSUSE Leap 15.1:libexiv2-doc-0.26-lp151.7.3.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-08T18:18:55Z", "details": "moderate" } ], "title": "CVE-2019-13114" } ] }
opensuse-su-2024:12399-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
exiv2-0.27.5-4.1 on GA media
Notes
Title of the patch
exiv2-0.27.5-4.1 on GA media
Description of the patch
These are all security issues fixed in the exiv2-0.27.5-4.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-12399
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "exiv2-0.27.5-4.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the exiv2-0.27.5-4.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-12399", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12399-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2017-1000126 page", "url": "https://www.suse.com/security/cve/CVE-2017-1000126/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-9239 page", "url": "https://www.suse.com/security/cve/CVE-2017-9239/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17229 page", "url": "https://www.suse.com/security/cve/CVE-2018-17229/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17230 page", "url": "https://www.suse.com/security/cve/CVE-2018-17230/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17282 page", "url": "https://www.suse.com/security/cve/CVE-2018-17282/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-19108 page", "url": "https://www.suse.com/security/cve/CVE-2018-19108/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-19607 page", "url": "https://www.suse.com/security/cve/CVE-2018-19607/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-9305 page", "url": "https://www.suse.com/security/cve/CVE-2018-9305/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13114 page", "url": "https://www.suse.com/security/cve/CVE-2019-13114/" } ], "title": "exiv2-0.27.5-4.1 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:12399-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "exiv2-0.27.5-4.1.aarch64", "product": { "name": "exiv2-0.27.5-4.1.aarch64", "product_id": "exiv2-0.27.5-4.1.aarch64" } }, { "category": "product_version", "name": "exiv2-lang-0.27.5-4.1.aarch64", "product": { "name": "exiv2-lang-0.27.5-4.1.aarch64", "product_id": "exiv2-lang-0.27.5-4.1.aarch64" } }, { "category": "product_version", "name": "libexiv2-27-0.27.5-4.1.aarch64", "product": { "name": "libexiv2-27-0.27.5-4.1.aarch64", "product_id": "libexiv2-27-0.27.5-4.1.aarch64" } }, { "category": "product_version", "name": "libexiv2-27-32bit-0.27.5-4.1.aarch64", "product": { "name": "libexiv2-27-32bit-0.27.5-4.1.aarch64", "product_id": "libexiv2-27-32bit-0.27.5-4.1.aarch64" } }, { "category": "product_version", "name": "libexiv2-devel-0.27.5-4.1.aarch64", "product": { "name": "libexiv2-devel-0.27.5-4.1.aarch64", "product_id": "libexiv2-devel-0.27.5-4.1.aarch64" } }, { "category": "product_version", "name": "libexiv2-xmp-static-0.27.5-4.1.aarch64", "product": { "name": "libexiv2-xmp-static-0.27.5-4.1.aarch64", "product_id": "libexiv2-xmp-static-0.27.5-4.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "exiv2-0.27.5-4.1.ppc64le", "product": { "name": "exiv2-0.27.5-4.1.ppc64le", "product_id": "exiv2-0.27.5-4.1.ppc64le" } }, { "category": "product_version", "name": "exiv2-lang-0.27.5-4.1.ppc64le", "product": { "name": "exiv2-lang-0.27.5-4.1.ppc64le", "product_id": "exiv2-lang-0.27.5-4.1.ppc64le" } }, { "category": "product_version", "name": "libexiv2-27-0.27.5-4.1.ppc64le", "product": { "name": "libexiv2-27-0.27.5-4.1.ppc64le", "product_id": "libexiv2-27-0.27.5-4.1.ppc64le" } }, { "category": "product_version", "name": "libexiv2-27-32bit-0.27.5-4.1.ppc64le", "product": { "name": "libexiv2-27-32bit-0.27.5-4.1.ppc64le", "product_id": "libexiv2-27-32bit-0.27.5-4.1.ppc64le" } }, { "category": "product_version", "name": "libexiv2-devel-0.27.5-4.1.ppc64le", "product": { "name": "libexiv2-devel-0.27.5-4.1.ppc64le", "product_id": "libexiv2-devel-0.27.5-4.1.ppc64le" } }, { "category": "product_version", "name": "libexiv2-xmp-static-0.27.5-4.1.ppc64le", "product": { "name": "libexiv2-xmp-static-0.27.5-4.1.ppc64le", "product_id": "libexiv2-xmp-static-0.27.5-4.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "exiv2-0.27.5-4.1.s390x", "product": { "name": "exiv2-0.27.5-4.1.s390x", "product_id": "exiv2-0.27.5-4.1.s390x" } }, { "category": "product_version", "name": "exiv2-lang-0.27.5-4.1.s390x", "product": { "name": "exiv2-lang-0.27.5-4.1.s390x", "product_id": "exiv2-lang-0.27.5-4.1.s390x" } }, { "category": "product_version", "name": "libexiv2-27-0.27.5-4.1.s390x", "product": { "name": "libexiv2-27-0.27.5-4.1.s390x", "product_id": "libexiv2-27-0.27.5-4.1.s390x" } }, { "category": "product_version", "name": "libexiv2-27-32bit-0.27.5-4.1.s390x", "product": { "name": "libexiv2-27-32bit-0.27.5-4.1.s390x", "product_id": "libexiv2-27-32bit-0.27.5-4.1.s390x" } }, { "category": "product_version", "name": "libexiv2-devel-0.27.5-4.1.s390x", "product": { "name": "libexiv2-devel-0.27.5-4.1.s390x", "product_id": "libexiv2-devel-0.27.5-4.1.s390x" } }, { "category": "product_version", "name": "libexiv2-xmp-static-0.27.5-4.1.s390x", "product": { "name": "libexiv2-xmp-static-0.27.5-4.1.s390x", "product_id": "libexiv2-xmp-static-0.27.5-4.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "exiv2-0.27.5-4.1.x86_64", "product": { "name": "exiv2-0.27.5-4.1.x86_64", "product_id": "exiv2-0.27.5-4.1.x86_64" } }, { "category": "product_version", "name": "exiv2-lang-0.27.5-4.1.x86_64", "product": { "name": "exiv2-lang-0.27.5-4.1.x86_64", "product_id": "exiv2-lang-0.27.5-4.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-27-0.27.5-4.1.x86_64", "product": { "name": "libexiv2-27-0.27.5-4.1.x86_64", "product_id": "libexiv2-27-0.27.5-4.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-27-32bit-0.27.5-4.1.x86_64", "product": { "name": "libexiv2-27-32bit-0.27.5-4.1.x86_64", "product_id": "libexiv2-27-32bit-0.27.5-4.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-devel-0.27.5-4.1.x86_64", "product": { "name": "libexiv2-devel-0.27.5-4.1.x86_64", "product_id": "libexiv2-devel-0.27.5-4.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-xmp-static-0.27.5-4.1.x86_64", "product": { "name": "libexiv2-xmp-static-0.27.5-4.1.x86_64", "product_id": "libexiv2-xmp-static-0.27.5-4.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "exiv2-0.27.5-4.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64" }, "product_reference": "exiv2-0.27.5-4.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "exiv2-0.27.5-4.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le" }, "product_reference": "exiv2-0.27.5-4.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "exiv2-0.27.5-4.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x" }, "product_reference": "exiv2-0.27.5-4.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "exiv2-0.27.5-4.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64" }, "product_reference": "exiv2-0.27.5-4.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "exiv2-lang-0.27.5-4.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64" }, "product_reference": "exiv2-lang-0.27.5-4.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "exiv2-lang-0.27.5-4.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le" }, "product_reference": "exiv2-lang-0.27.5-4.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "exiv2-lang-0.27.5-4.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x" }, "product_reference": "exiv2-lang-0.27.5-4.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "exiv2-lang-0.27.5-4.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64" }, "product_reference": "exiv2-lang-0.27.5-4.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-27-0.27.5-4.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64" }, "product_reference": "libexiv2-27-0.27.5-4.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-27-0.27.5-4.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le" }, "product_reference": "libexiv2-27-0.27.5-4.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-27-0.27.5-4.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x" }, "product_reference": "libexiv2-27-0.27.5-4.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-27-0.27.5-4.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64" }, "product_reference": "libexiv2-27-0.27.5-4.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-27-32bit-0.27.5-4.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64" }, "product_reference": "libexiv2-27-32bit-0.27.5-4.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-27-32bit-0.27.5-4.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le" }, "product_reference": "libexiv2-27-32bit-0.27.5-4.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-27-32bit-0.27.5-4.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x" }, "product_reference": "libexiv2-27-32bit-0.27.5-4.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-27-32bit-0.27.5-4.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64" }, "product_reference": "libexiv2-27-32bit-0.27.5-4.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.27.5-4.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64" }, "product_reference": "libexiv2-devel-0.27.5-4.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.27.5-4.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le" }, "product_reference": "libexiv2-devel-0.27.5-4.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.27.5-4.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x" }, "product_reference": "libexiv2-devel-0.27.5-4.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.27.5-4.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64" }, "product_reference": "libexiv2-devel-0.27.5-4.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-xmp-static-0.27.5-4.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64" }, "product_reference": "libexiv2-xmp-static-0.27.5-4.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-xmp-static-0.27.5-4.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le" }, "product_reference": "libexiv2-xmp-static-0.27.5-4.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-xmp-static-0.27.5-4.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x" }, "product_reference": "libexiv2-xmp-static-0.27.5-4.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-xmp-static-0.27.5-4.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" }, "product_reference": "libexiv2-xmp-static-0.27.5-4.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-1000126", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-1000126" } ], "notes": [ { "category": "general", "text": "exiv2 0.26 contains a Stack out of bounds read in webp parser", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-1000126", "url": "https://www.suse.com/security/cve/CVE-2017-1000126" }, { "category": "external", "summary": "SUSE Bug 1068873 for CVE-2017-1000126", "url": "https://bugzilla.suse.com/1068873" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2017-1000126" }, { "cve": "CVE-2017-9239", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-9239" } ], "notes": [ { "category": "general", "text": "An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-9239", "url": "https://www.suse.com/security/cve/CVE-2017-9239" }, { "category": "external", "summary": "SUSE Bug 1040973 for CVE-2017-9239", "url": "https://bugzilla.suse.com/1040973" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2017-9239" }, { "cve": "CVE-2018-17229", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-17229" } ], "notes": [ { "category": "general", "text": "Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-17229", "url": "https://www.suse.com/security/cve/CVE-2018-17229" }, { "category": "external", "summary": "SUSE Bug 1109175 for CVE-2018-17229", "url": "https://bugzilla.suse.com/1109175" }, { "category": "external", "summary": "SUSE Bug 1109176 for CVE-2018-17229", "url": "https://bugzilla.suse.com/1109176" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-17229" }, { "cve": "CVE-2018-17230", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-17230" } ], "notes": [ { "category": "general", "text": "Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-17230", "url": "https://www.suse.com/security/cve/CVE-2018-17230" }, { "category": "external", "summary": "SUSE Bug 1109176 for CVE-2018-17230", "url": "https://bugzilla.suse.com/1109176" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2018-17230" }, { "cve": "CVE-2018-17282", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-17282" } ], "notes": [ { "category": "general", "text": "An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-17282", "url": "https://www.suse.com/security/cve/CVE-2018-17282" }, { "category": "external", "summary": "SUSE Bug 1109299 for CVE-2018-17282", "url": "https://bugzilla.suse.com/1109299" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-17282" }, { "cve": "CVE-2018-19108", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-19108" } ], "notes": [ { "category": "general", "text": "In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-19108", "url": "https://www.suse.com/security/cve/CVE-2018-19108" }, { "category": "external", "summary": "SUSE Bug 1115364 for CVE-2018-19108", "url": "https://bugzilla.suse.com/1115364" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-19108" }, { "cve": "CVE-2018-19607", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-19607" } ], "notes": [ { "category": "general", "text": "Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-19607", "url": "https://www.suse.com/security/cve/CVE-2018-19607" }, { "category": "external", "summary": "SUSE Bug 1117513 for CVE-2018-19607", "url": "https://bugzilla.suse.com/1117513" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-19607" }, { "cve": "CVE-2018-9305", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-9305" } ], "notes": [ { "category": "general", "text": "In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the \"== 0x1c\" case.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-9305", "url": "https://www.suse.com/security/cve/CVE-2018-9305" }, { "category": "external", "summary": "SUSE Bug 1088424 for CVE-2018-9305", "url": "https://bugzilla.suse.com/1088424" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "low" } ], "title": "CVE-2018-9305" }, { "cve": "CVE-2019-13114", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-13114" } ], "notes": [ { "category": "general", "text": "http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-13114", "url": "https://www.suse.com/security/cve/CVE-2019-13114" }, { "category": "external", "summary": "SUSE Bug 1142684 for CVE-2019-13114", "url": "https://bugzilla.suse.com/1142684" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:exiv2-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.s390x", "openSUSE Tumbleweed:exiv2-lang-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-27-32bit-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-devel-0.27.5-4.1.x86_64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.aarch64", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.ppc64le", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.s390x", "openSUSE Tumbleweed:libexiv2-xmp-static-0.27.5-4.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2019-13114" } ] }
suse-su-2020:0921-1
Vulnerability from csaf_suse
Published
2020-04-03 15:14
Modified
2020-04-03 15:14
Summary
Security update for exiv2
Notes
Title of the patch
Security update for exiv2
Description of the patch
This update for exiv2 fixes the following issues:
exiv2 was updated to latest 0.26 branch, fixing bugs and security issues:
- CVE-2017-1000126: Fixed an out of bounds read in webp parser (bsc#1068873).
- CVE-2017-9239: Fixed a segmentation fault in TiffImageEntry::doWriteImage function (bsc#1040973).
- CVE-2018-12264: Fixed an integer overflow in LoaderTiff::getData() which
might have led to an out-of-bounds read (bsc#1097600).
- CVE-2018-12265: Fixed integer overflows in LoaderExifJpeg which could have
led to memory corruption (bsc#1097599).
- CVE-2018-17229: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109175).
- CVE-2018-17230: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109176).
- CVE-2018-17282: Fixed a null pointer dereference in Exiv2::DataValue::copy (bsc#1109299).
- CVE-2018-19108: Fixed an integer overflow in Exiv2::PsdImage::readMetadata which could have
led to infinite loop (bsc#1115364).
- CVE-2018-19607: Fixed a null pointer dereference in Exiv2::isoSpeed which might have led to denial
of service (bsc#1117513).
- CVE-2018-9305: Fixed an out of bounds read in IptcData::printStructure which might have led to
to information leak or denial of service (bsc#1088424).
- CVE-2019-13114: Fixed a null pointer dereference which might have led to denial of service via
a crafted response of an malicious http server (bsc#1142684).
Patchnames
SUSE-2020-921,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-921,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-921
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for exiv2", "title": "Title of the patch" }, { "category": "description", "text": "This update for exiv2 fixes the following issues:\n\nexiv2 was updated to latest 0.26 branch, fixing bugs and security issues:\n\n- CVE-2017-1000126: Fixed an out of bounds read in webp parser (bsc#1068873).\n- CVE-2017-9239: Fixed a segmentation fault in TiffImageEntry::doWriteImage function (bsc#1040973).\n- CVE-2018-12264: Fixed an integer overflow in LoaderTiff::getData() which\n might have led to an out-of-bounds read (bsc#1097600).\n- CVE-2018-12265: Fixed integer overflows in LoaderExifJpeg which could have \n led to memory corruption (bsc#1097599).\n- CVE-2018-17229: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109175).\n- CVE-2018-17230: Fixed a heap based buffer overflow in Exiv2::d2Data via a crafted image (bsc#1109176).\n- CVE-2018-17282: Fixed a null pointer dereference in Exiv2::DataValue::copy (bsc#1109299).\n- CVE-2018-19108: Fixed an integer overflow in Exiv2::PsdImage::readMetadata which could have \n led to infinite loop (bsc#1115364).\n- CVE-2018-19607: Fixed a null pointer dereference in Exiv2::isoSpeed which might have led to denial \n of service (bsc#1117513).\n- CVE-2018-9305: Fixed an out of bounds read in IptcData::printStructure which might have led to \n to information leak or denial of service (bsc#1088424).\n- CVE-2019-13114: Fixed a null pointer dereference which might have led to denial of service via \n a crafted response of an malicious http server (bsc#1142684).\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-2020-921,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-921,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-921", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_0921-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2020:0921-1", "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200921-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2020:0921-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2020-April/006676.html" }, { "category": "self", "summary": "SUSE Bug 1040973", "url": "https://bugzilla.suse.com/1040973" }, { "category": "self", "summary": "SUSE Bug 1068873", "url": "https://bugzilla.suse.com/1068873" }, { "category": "self", "summary": "SUSE Bug 1088424", "url": "https://bugzilla.suse.com/1088424" }, { "category": "self", "summary": "SUSE Bug 1097599", "url": "https://bugzilla.suse.com/1097599" }, { "category": "self", "summary": "SUSE Bug 1097600", "url": "https://bugzilla.suse.com/1097600" }, { "category": "self", "summary": "SUSE Bug 1109175", "url": "https://bugzilla.suse.com/1109175" }, { "category": "self", "summary": "SUSE Bug 1109176", "url": "https://bugzilla.suse.com/1109176" }, { "category": "self", "summary": "SUSE Bug 1109299", "url": "https://bugzilla.suse.com/1109299" }, { "category": "self", "summary": "SUSE Bug 1115364", "url": "https://bugzilla.suse.com/1115364" }, { "category": "self", "summary": "SUSE Bug 1117513", "url": "https://bugzilla.suse.com/1117513" }, { "category": "self", "summary": "SUSE Bug 1142684", "url": "https://bugzilla.suse.com/1142684" }, { "category": "self", "summary": "SUSE CVE CVE-2017-1000126 page", "url": "https://www.suse.com/security/cve/CVE-2017-1000126/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-9239 page", "url": "https://www.suse.com/security/cve/CVE-2017-9239/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-12264 page", "url": "https://www.suse.com/security/cve/CVE-2018-12264/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-12265 page", "url": "https://www.suse.com/security/cve/CVE-2018-12265/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17229 page", "url": "https://www.suse.com/security/cve/CVE-2018-17229/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17230 page", "url": "https://www.suse.com/security/cve/CVE-2018-17230/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17282 page", "url": "https://www.suse.com/security/cve/CVE-2018-17282/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-19108 page", "url": "https://www.suse.com/security/cve/CVE-2018-19108/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-19607 page", "url": "https://www.suse.com/security/cve/CVE-2018-19607/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-9305 page", "url": "https://www.suse.com/security/cve/CVE-2018-9305/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13114 page", "url": "https://www.suse.com/security/cve/CVE-2019-13114/" } ], "title": "Security update for exiv2", "tracking": { "current_release_date": "2020-04-03T15:14:14Z", "generator": { "date": "2020-04-03T15:14:14Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2020:0921-1", "initial_release_date": "2020-04-03T15:14:14Z", "revision_history": [ { "date": "2020-04-03T15:14:14Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "exiv2-0.26-6.8.1.aarch64", "product": { "name": "exiv2-0.26-6.8.1.aarch64", "product_id": "exiv2-0.26-6.8.1.aarch64" } }, { "category": "product_version", "name": "libexiv2-26-0.26-6.8.1.aarch64", "product": { "name": "libexiv2-26-0.26-6.8.1.aarch64", "product_id": "libexiv2-26-0.26-6.8.1.aarch64" } }, { "category": "product_version", "name": "libexiv2-devel-0.26-6.8.1.aarch64", "product": { "name": "libexiv2-devel-0.26-6.8.1.aarch64", "product_id": "libexiv2-devel-0.26-6.8.1.aarch64" } }, { "category": "product_version", "name": "libexiv2-doc-0.26-6.8.1.aarch64", "product": { "name": "libexiv2-doc-0.26-6.8.1.aarch64", "product_id": "libexiv2-doc-0.26-6.8.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libexiv2-26-64bit-0.26-6.8.1.aarch64_ilp32", "product": { "name": "libexiv2-26-64bit-0.26-6.8.1.aarch64_ilp32", "product_id": "libexiv2-26-64bit-0.26-6.8.1.aarch64_ilp32" } } ], "category": "architecture", "name": "aarch64_ilp32" }, { "branches": [ { "category": "product_version", "name": "exiv2-0.26-6.8.1.i586", "product": { "name": "exiv2-0.26-6.8.1.i586", "product_id": "exiv2-0.26-6.8.1.i586" } }, { "category": "product_version", "name": "libexiv2-26-0.26-6.8.1.i586", "product": { "name": "libexiv2-26-0.26-6.8.1.i586", "product_id": "libexiv2-26-0.26-6.8.1.i586" } }, { "category": "product_version", "name": "libexiv2-devel-0.26-6.8.1.i586", "product": { "name": "libexiv2-devel-0.26-6.8.1.i586", "product_id": "libexiv2-devel-0.26-6.8.1.i586" } }, { "category": "product_version", "name": "libexiv2-doc-0.26-6.8.1.i586", "product": { "name": "libexiv2-doc-0.26-6.8.1.i586", "product_id": "libexiv2-doc-0.26-6.8.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "exiv2-lang-0.26-6.8.1.noarch", "product": { "name": "exiv2-lang-0.26-6.8.1.noarch", "product_id": "exiv2-lang-0.26-6.8.1.noarch" } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "exiv2-0.26-6.8.1.ppc64le", "product": { "name": "exiv2-0.26-6.8.1.ppc64le", "product_id": "exiv2-0.26-6.8.1.ppc64le" } }, { "category": "product_version", "name": "libexiv2-26-0.26-6.8.1.ppc64le", "product": { "name": "libexiv2-26-0.26-6.8.1.ppc64le", "product_id": "libexiv2-26-0.26-6.8.1.ppc64le" } }, { "category": "product_version", "name": "libexiv2-devel-0.26-6.8.1.ppc64le", "product": { "name": "libexiv2-devel-0.26-6.8.1.ppc64le", "product_id": "libexiv2-devel-0.26-6.8.1.ppc64le" } }, { "category": "product_version", "name": "libexiv2-doc-0.26-6.8.1.ppc64le", "product": { "name": "libexiv2-doc-0.26-6.8.1.ppc64le", "product_id": "libexiv2-doc-0.26-6.8.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "exiv2-0.26-6.8.1.s390x", "product": { "name": "exiv2-0.26-6.8.1.s390x", "product_id": "exiv2-0.26-6.8.1.s390x" } }, { "category": "product_version", "name": "libexiv2-26-0.26-6.8.1.s390x", "product": { "name": "libexiv2-26-0.26-6.8.1.s390x", "product_id": "libexiv2-26-0.26-6.8.1.s390x" } }, { "category": "product_version", "name": "libexiv2-devel-0.26-6.8.1.s390x", "product": { "name": "libexiv2-devel-0.26-6.8.1.s390x", "product_id": "libexiv2-devel-0.26-6.8.1.s390x" } }, { "category": "product_version", "name": "libexiv2-doc-0.26-6.8.1.s390x", "product": { "name": "libexiv2-doc-0.26-6.8.1.s390x", "product_id": "libexiv2-doc-0.26-6.8.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "exiv2-0.26-6.8.1.x86_64", "product": { "name": "exiv2-0.26-6.8.1.x86_64", "product_id": "exiv2-0.26-6.8.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-26-0.26-6.8.1.x86_64", "product": { "name": "libexiv2-26-0.26-6.8.1.x86_64", "product_id": "libexiv2-26-0.26-6.8.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-26-32bit-0.26-6.8.1.x86_64", "product": { "name": "libexiv2-26-32bit-0.26-6.8.1.x86_64", "product_id": "libexiv2-26-32bit-0.26-6.8.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-devel-0.26-6.8.1.x86_64", "product": { "name": "libexiv2-devel-0.26-6.8.1.x86_64", "product_id": "libexiv2-devel-0.26-6.8.1.x86_64" } }, { "category": "product_version", "name": "libexiv2-doc-0.26-6.8.1.x86_64", "product": { "name": "libexiv2-doc-0.26-6.8.1.x86_64", "product_id": "libexiv2-doc-0.26-6.8.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product": { "name": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-module-desktop-applications:15:sp1" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libexiv2-26-0.26-6.8.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64" }, "product_reference": "libexiv2-26-0.26-6.8.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-26-0.26-6.8.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le" }, "product_reference": "libexiv2-26-0.26-6.8.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-26-0.26-6.8.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x" }, "product_reference": "libexiv2-26-0.26-6.8.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-26-0.26-6.8.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64" }, "product_reference": "libexiv2-26-0.26-6.8.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.26-6.8.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64" }, "product_reference": "libexiv2-devel-0.26-6.8.1.aarch64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.26-6.8.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le" }, "product_reference": "libexiv2-devel-0.26-6.8.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.26-6.8.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x" }, "product_reference": "libexiv2-devel-0.26-6.8.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "libexiv2-devel-0.26-6.8.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1", "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" }, "product_reference": "libexiv2-devel-0.26-6.8.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP1" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-1000126", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-1000126" } ], "notes": [ { "category": "general", "text": "exiv2 0.26 contains a Stack out of bounds read in webp parser", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-1000126", "url": "https://www.suse.com/security/cve/CVE-2017-1000126" }, { "category": "external", "summary": "SUSE Bug 1068873 for CVE-2017-1000126", "url": "https://bugzilla.suse.com/1068873" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "moderate" } ], "title": "CVE-2017-1000126" }, { "cve": "CVE-2017-9239", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2017-9239" } ], "notes": [ { "category": "general", "text": "An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2017-9239", "url": "https://www.suse.com/security/cve/CVE-2017-9239" }, { "category": "external", "summary": "SUSE Bug 1040973 for CVE-2017-9239", "url": "https://bugzilla.suse.com/1040973" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "low" } ], "title": "CVE-2017-9239" }, { "cve": "CVE-2018-12264", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-12264" } ], "notes": [ { "category": "general", "text": "Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-12264", "url": "https://www.suse.com/security/cve/CVE-2018-12264" }, { "category": "external", "summary": "SUSE Bug 1097600 for CVE-2018-12264", "url": "https://bugzilla.suse.com/1097600" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "low" } ], "title": "CVE-2018-12264" }, { "cve": "CVE-2018-12265", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-12265" } ], "notes": [ { "category": "general", "text": "Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-12265", "url": "https://www.suse.com/security/cve/CVE-2018-12265" }, { "category": "external", "summary": "SUSE Bug 1097599 for CVE-2018-12265", "url": "https://bugzilla.suse.com/1097599" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "low" } ], "title": "CVE-2018-12265" }, { "cve": "CVE-2018-17229", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-17229" } ], "notes": [ { "category": "general", "text": "Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-17229", "url": "https://www.suse.com/security/cve/CVE-2018-17229" }, { "category": "external", "summary": "SUSE Bug 1109175 for CVE-2018-17229", "url": "https://bugzilla.suse.com/1109175" }, { "category": "external", "summary": "SUSE Bug 1109176 for CVE-2018-17229", "url": "https://bugzilla.suse.com/1109176" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "low" } ], "title": "CVE-2018-17229" }, { "cve": "CVE-2018-17230", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-17230" } ], "notes": [ { "category": "general", "text": "Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-17230", "url": "https://www.suse.com/security/cve/CVE-2018-17230" }, { "category": "external", "summary": "SUSE Bug 1109176 for CVE-2018-17230", "url": "https://bugzilla.suse.com/1109176" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "moderate" } ], "title": "CVE-2018-17230" }, { "cve": "CVE-2018-17282", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-17282" } ], "notes": [ { "category": "general", "text": "An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-17282", "url": "https://www.suse.com/security/cve/CVE-2018-17282" }, { "category": "external", "summary": "SUSE Bug 1109299 for CVE-2018-17282", "url": "https://bugzilla.suse.com/1109299" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "low" } ], "title": "CVE-2018-17282" }, { "cve": "CVE-2018-19108", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-19108" } ], "notes": [ { "category": "general", "text": "In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-19108", "url": "https://www.suse.com/security/cve/CVE-2018-19108" }, { "category": "external", "summary": "SUSE Bug 1115364 for CVE-2018-19108", "url": "https://bugzilla.suse.com/1115364" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "low" } ], "title": "CVE-2018-19108" }, { "cve": "CVE-2018-19607", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-19607" } ], "notes": [ { "category": "general", "text": "Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-19607", "url": "https://www.suse.com/security/cve/CVE-2018-19607" }, { "category": "external", "summary": "SUSE Bug 1117513 for CVE-2018-19607", "url": "https://bugzilla.suse.com/1117513" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "low" } ], "title": "CVE-2018-19607" }, { "cve": "CVE-2018-9305", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2018-9305" } ], "notes": [ { "category": "general", "text": "In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the \"== 0x1c\" case.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2018-9305", "url": "https://www.suse.com/security/cve/CVE-2018-9305" }, { "category": "external", "summary": "SUSE Bug 1088424 for CVE-2018-9305", "url": "https://bugzilla.suse.com/1088424" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "low" } ], "title": "CVE-2018-9305" }, { "cve": "CVE-2019-13114", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2019-13114" } ], "notes": [ { "category": "general", "text": "http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2019-13114", "url": "https://www.suse.com/security/cve/CVE-2019-13114" }, { "category": "external", "summary": "SUSE Bug 1142684 for CVE-2019-13114", "url": "https://bugzilla.suse.com/1142684" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-26-0.26-6.8.1.x86_64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.aarch64", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.ppc64le", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.s390x", "SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libexiv2-devel-0.26-6.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2020-04-03T15:14:14Z", "details": "moderate" } ], "title": "CVE-2019-13114" } ] }
gsd-2017-1000126
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
exiv2 0.26 contains a Stack out of bounds read in webp parser
Aliases
Aliases
{ "GSD": { "alias": "CVE-2017-1000126", "description": "exiv2 0.26 contains a Stack out of bounds read in webp parser", "id": "GSD-2017-1000126", "references": [ "https://www.suse.com/security/cve/CVE-2017-1000126.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2017-1000126" ], "details": "exiv2 0.26 contains a Stack out of bounds read in webp parser", "id": "GSD-2017-1000126", "modified": "2023-12-13T01:21:02.245632Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "DATE_ASSIGNED": "2017-08-22T17:29:33.340007", "ID": "CVE-2017-1000126", "REQUESTER": "hanno@hboeck.de", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "exiv2 0.26 contains a Stack out of bounds read in webp parser" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "[oss-security] 20170630 exiv2: multiple memory safety issues", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" }, { "name": "openSUSE-SU-2020:0482", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:exiv2:exiv2:0.26:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-1000126" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "exiv2 0.26 contains a Stack out of bounds read in webp parser" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-125" } ] } ] }, "references": { "reference_data": [ { "name": "[oss-security] 20170630 exiv2: multiple memory safety issues", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory", "VDB Entry" ], "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" }, { "name": "openSUSE-SU-2020:0482", "refsource": "SUSE", "tags": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "exploitabilityScore": 1.8, "impactScore": 3.6 } }, "lastModifiedDate": "2020-04-09T00:15Z", "publishedDate": "2017-11-17T22:29Z" } } }
fkie_cve-2017-1000126
Vulnerability from fkie_nvd
Published
2017-11-17 22:29
Modified
2025-04-20 01:37
Severity ?
Summary
exiv2 0.26 contains a Stack out of bounds read in webp parser
References
▶ | URL | Tags | |
---|---|---|---|
cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html | ||
cve@mitre.org | http://www.openwall.com/lists/oss-security/2017/06/30/1 | Mailing List, Third Party Advisory, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html | ||
af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2017/06/30/1 | Mailing List, Third Party Advisory, VDB Entry |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:exiv2:exiv2:0.26:*:*:*:*:*:*:*", "matchCriteriaId": "D46E025A-62BF-4024-BB8D-D8C2FFE1D213", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "exiv2 0.26 contains a Stack out of bounds read in webp parser" }, { "lang": "es", "value": "exiv2 0.26 contiene una vulnerabilidad de lectura de pila fuera de l\u00edmites en el analizador webp." } ], "id": "CVE-2017-1000126", "lastModified": "2025-04-20T01:37:25.860", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2017-11-17T22:29:00.220", "references": [ { "source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html" }, { "source": "cve@mitre.org", "tags": [ "Mailing List", "Third Party Advisory", "VDB Entry" ], "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory", "VDB Entry" ], "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-125" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
pysec-2017-115
Vulnerability from pysec
Published
2017-11-17 22:29
Modified
2024-11-21 14:22
Severity ?
Details
exiv2 0.26 contains a Stack out of bounds read in webp parser
Impacted products
Name | purl | exiv2 | pkg:pypi/exiv2 |
---|
Aliases
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "exiv2", "purl": "pkg:pypi/exiv2" }, "ranges": [ { "events": [ { "introduced": "0" } ], "type": "ECOSYSTEM" } ], "versions": [ "0.1", "0.11.0", "0.11.1", "0.11.2", "0.11.3", "0.12.0", "0.12.1", "0.13.0", "0.13.1", "0.13.2", "0.14.0", "0.14.1", "0.15.0", "0.16.0", "0.16.1", "0.16.2", "0.16.2.post1", "0.16.3", "0.16.3.post1", "0.17.0", "0.17.1", "0.2", "0.3", "0.3.1" ] } ], "aliases": [ "CVE-2017-1000126" ], "details": "exiv2 0.26 contains a Stack out of bounds read in webp parser", "id": "PYSEC-2017-115", "modified": "2024-11-21T14:22:45.992477Z", "published": "2017-11-17T22:29:00Z", "references": [ { "type": "ARTICLE", "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" }, { "type": "ADVISORY", "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html" } ], "severity": [ { "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "withdrawn": "2024-11-22T04:37:03Z" }
ghsa-fx47-xw7j-wjc9
Vulnerability from github
Published
2022-05-13 01:27
Modified
2022-05-13 01:27
Severity ?
VLAI Severity ?
Details
exiv2 0.26 contains a Stack out of bounds read in webp parser
{ "affected": [], "aliases": [ "CVE-2017-1000126" ], "database_specific": { "cwe_ids": [ "CWE-125" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2017-11-17T22:29:00Z", "severity": "MODERATE" }, "details": "exiv2 0.26 contains a Stack out of bounds read in webp parser", "id": "GHSA-fx47-xw7j-wjc9", "modified": "2022-05-13T01:27:27Z", "published": "2022-05-13T01:27:27Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000126" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2017/06/30/1" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…