Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

exiv2: CVE-2019-13504

Related Vulnerabilities: CVE-2019-13504  

Source

Debian Bug report logs - #932467
exiv2: CVE-2019-13504

version graph

Package: src:exiv2; Maintainer for src:exiv2 is Debian KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>;

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Fri, 19 Jul 2019 18:57:02 UTC

Severity: important

Tags: security, upstream

Found in versions exiv2/0.25-4, exiv2/0.25-3.1+deb9u1, exiv2/0.25-1

Forwarded to https://github.com/Exiv2/exiv2/pull/943

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>:
Bug#932467; Package src:exiv2. (Fri, 19 Jul 2019 18:57:05 GMT) (full text, mbox, link).

Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>. (Fri, 19 Jul 2019 18:57:05 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: exiv2: CVE-2019-13504
Date: Fri, 19 Jul 2019 20:54:04 +0200
Source: exiv2
Version: 0.25-4
Severity: important
Tags: security upstream
Forwarded: https://github.com/Exiv2/exiv2/pull/943
Control: found -1 0.25-1
Control: found -1 0.25-3.1+deb9u1

Hi,

The following vulnerability was published for exiv2.

CVE-2019-13504[0]:
| There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in
| mrwimage.cpp in Exiv2 through 0.27.2.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-13504
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13504
[1] https://github.com/Exiv2/exiv2/pull/943
[2] https://github.com/Exiv2/exiv2/commit/54f0bebca032d0286a0e48f47e67dfc6141fedff

Regards,
Salvatore

Marked as found in versions exiv2/0.25-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Fri, 19 Jul 2019 18:57:05 GMT) (full text, mbox, link).

Marked as found in versions exiv2/0.25-3.1+deb9u1. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Fri, 19 Jul 2019 18:57:06 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Jul 20 11:22:10 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started