Security update for exiv2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0860-1 Final 1 1 2020-04-03T07:01:56Z current 2020-04-03T07:01:56Z 2020-04-03T07:01:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for exiv2 This update for exiv2 fixes the following issues: - CVE-2018-17581: Fixed an excessive stack consumption in CiffDirectory:readDirectory() which might have led to denial of service (bsc#1110282). - CVE-2019-13110: Fixed an integer overflow and an out of bounds read in CiffDirectory:readDirectory which might have led to denial of service (bsc#1142678). - CVE-2019-13113: Fixed a potential denial of service via an invalid data location in a CRW image (bsc#1142683). - CVE-2019-17402: Fixed an improper validation of the relationship of the total size to the offset and size in Exiv2::getULong (bsc#1153577). - CVE-2019-20421: Fixed an infinite loop triggered via an input file (bsc#1161901). - CVE-2017-9239: Fixed a segmentation fault in TiffImageEntry::doWriteImage function (bsc#1040973). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-860,SUSE-SLE-SDK-12-SP4-2020-860,SUSE-SLE-SDK-12-SP5-2020-860,SUSE-SLE-SERVER-12-SP4-2020-860,SUSE-SLE-SERVER-12-SP5-2020-860 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200860-1/ Link for SUSE-SU-2020:0860-1 https://lists.suse.com/pipermail/sle-security-updates/2020-April/006670.html E-Mail link for SUSE-SU-2020:0860-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1040973 SUSE Bug 1040973 https://bugzilla.suse.com/1110282 SUSE Bug 1110282 https://bugzilla.suse.com/1142678 SUSE Bug 1142678 https://bugzilla.suse.com/1142683 SUSE Bug 1142683 https://bugzilla.suse.com/1153577 SUSE Bug 1153577 https://bugzilla.suse.com/1161901 SUSE Bug 1161901 https://www.suse.com/security/cve/CVE-2017-9239/ SUSE CVE CVE-2017-9239 page https://www.suse.com/security/cve/CVE-2018-17581/ SUSE CVE CVE-2018-17581 page https://www.suse.com/security/cve/CVE-2019-13110/ SUSE CVE CVE-2019-13110 page https://www.suse.com/security/cve/CVE-2019-13113/ SUSE CVE CVE-2019-13113 page https://www.suse.com/security/cve/CVE-2019-17402/ SUSE CVE CVE-2019-17402 page https://www.suse.com/security/cve/CVE-2019-20421/ SUSE CVE CVE-2019-20421 page SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 exiv2-0.23-12.8.1 exiv2-lang-0.23-12.8.1 libexiv2-12-0.23-12.8.1 libexiv2-12-32bit-0.23-12.8.1 libexiv2-12-64bit-0.23-12.8.1 libexiv2-devel-0.23-12.8.1 libexiv2-12-0.23-12.8.1 as a component of SUSE Linux Enterprise Server 12 SP4 libexiv2-12-0.23-12.8.1 as a component of SUSE Linux Enterprise Server 12 SP5 libexiv2-12-0.23-12.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libexiv2-12-0.23-12.8.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libexiv2-devel-0.23-12.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libexiv2-devel-0.23-12.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file. CVE-2017-9239 SUSE Linux Enterprise Server 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libexiv2-devel-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libexiv2-devel-0.23-12.8.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200860-1/ https://www.suse.com/security/cve/CVE-2017-9239.html CVE-2017-9239 https://bugzilla.suse.com/1040973 SUSE Bug 1040973 CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service. CVE-2018-17581 SUSE Linux Enterprise Server 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libexiv2-devel-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libexiv2-devel-0.23-12.8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200860-1/ https://www.suse.com/security/cve/CVE-2018-17581.html CVE-2018-17581 https://bugzilla.suse.com/1110282 SUSE Bug 1110282 A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file. CVE-2019-13110 SUSE Linux Enterprise Server 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libexiv2-devel-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libexiv2-devel-0.23-12.8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200860-1/ https://www.suse.com/security/cve/CVE-2019-13110.html CVE-2019-13110 https://bugzilla.suse.com/1142678 SUSE Bug 1142678 Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file. CVE-2019-13113 SUSE Linux Enterprise Server 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libexiv2-devel-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libexiv2-devel-0.23-12.8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200860-1/ https://www.suse.com/security/cve/CVE-2019-13113.html CVE-2019-13113 https://bugzilla.suse.com/1142683 SUSE Bug 1142683 Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size. CVE-2019-17402 SUSE Linux Enterprise Server 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libexiv2-devel-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libexiv2-devel-0.23-12.8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200860-1/ https://www.suse.com/security/cve/CVE-2019-17402.html CVE-2019-17402 https://bugzilla.suse.com/1153577 SUSE Bug 1153577 In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. CVE-2019-20421 SUSE Linux Enterprise Server 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libexiv2-12-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libexiv2-devel-0.23-12.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libexiv2-devel-0.23-12.8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200860-1/ https://www.suse.com/security/cve/CVE-2019-20421.html CVE-2019-20421 https://bugzilla.suse.com/1161901 SUSE Bug 1161901