Debian Bug report logs -
#916081
exiv2: CVE-2018-16336
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>:
Bug#916081; Package src:exiv2.
(Sun, 09 Dec 2018 21:09:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>.
(Sun, 09 Dec 2018 21:09:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: exiv2
Version: 0.25-4
Severity: important
Tags: patch security upstream
Forwarded: https://github.com/Exiv2/exiv2/issues/400
Control: found -1 0.26-1
Hi,
The following vulnerability was published for exiv2.
CVE-2018-16336[0]:
| Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote
| attackers to cause a denial of service (heap-based buffer over-read)
| via a crafted image file, a different vulnerability than
| CVE-2018-10999.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2018-16336
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16336
[1] https://github.com/Exiv2/exiv2/issues/400
[2] https://github.com/Exiv2/exiv2/commit/35b3e596edacd2437c2c5d3dd2b5c9502626163d
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
Marked as found in versions exiv2/0.26-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to submit@bugs.debian.org.
(Sun, 09 Dec 2018 21:09:04 GMT) (full text, mbox, link).
Added tag(s) fixed-upstream.
Request was from debian-bts-link@lists.debian.org
to control@bugs.debian.org.
(Thu, 13 Dec 2018 17:18:05 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Debian KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>:
Bug#916081; Package src:exiv2.
(Sat, 30 Mar 2019 19:21:06 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Mühlenhoff <jmm@inutil.org>:
Extra info received and forwarded to list. Copy sent to Debian KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>.
(Sat, 30 Mar 2019 19:21:06 GMT) (full text, mbox, link).
Message #14 received at 916081@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Attached patch fixes most open security issues in testing/sid
(as applied by Leonidas S. Barbosa in Ubuntu), but needs
additional work to deal with the versioned symbols fallout
caused by GCC changes which happened after the last exiv upload
to sid.
[exiv-sec.diff (text/x-diff, attachment)]
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 14:58:19 2019;
Machine Name:
beach
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon