|
exiv2 (0.27.2-8ubuntu2.6) focal-security; urgency=medium
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2021-32815-*.patch: adds a check of sizes, adds
regression test, adds msgs prints for DEBUG flags in
src/crwimage_int.cpp.
- CVE-2021-32815
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2021-34334-*.patch: adds regression test, adds
an extra checking to prevent the loop counter from wrapping around in
crwimage_int.cpp; adds defensive code to avoid integer overflow in loop
conditions in src/actions.cpp, src/basicio.cpp, src/convert.cpp,
src/exif.cpp, src/exvi2.cpp, src/iptc.cpp, src/preview.cpp,
src/tags_int.cpp, src/tiffcomposite_int.cpp, src/types.cpp,
src/xmp.cpp, src/xmpsidecar.cpp; adds a better fix for a potential
integer overflow in bytes.size() in src/iptc.cpp; changes type of
escapeStart to size_t in src/exiv2.cpp; fix warning comparison of
integer expressions of different signedness in src/iptc.cpp,
src/tags_int.cpp.
- CVE-2021-34334
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2021-34335-*.patch: adds regression test;
prevent divide-by-zero crash in src/minoltamn_int.cpp; adds defensive
code in include/exiv2/value.hpp, src/tags_int.cpp.
- CVE-2021-34335
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2021-37615-37616-*.patch: adds regression test;
throw exception if lens info wasn't found in src/pentaxmn_int.cpp;
adds a check to findKey din't return end() in src/convert.cpp,
src/crwimage_int.cpp, src/exif.cpp, src/iptc.cpp, src/xmp.cpp.
- CVE-2021-37615
- CVE-2021-37616
* SECURITY UPDATE: Out-of-bounds read
- debian/patches/CVE-2021-37618-*.patch: adds regression test; adds
a better bounds checking for Jp2Image::printStructure in
src/jp2image.cpp.
- CVE-2021-37618
* SECURITY UPDATE: Out-of-bounds read
- debian/patches/CVE-2021-37619-*.patch: adds regression test;
fix incorrect loop condition in src/jp2image.cpp.
- CVE-2021-37619
* SECURITY UPDATE: Out-of-bounds read
- debian/patches/CVE-2021-37620-*.patch: adds regression test;
check that type isn't an empty string in src/values.cpp and
adds safer vector indexing in multiples files in src/*.
- CVE-2021-37620
* SECURITY UPDATE: Infinite loop
- debian/patches/CVE-2021-37621-*.patch: adds regression test;
checks dirlength to avoid infinite loop and adds some defensive code in
src/image.cpp.
- CVE-2021-37621
* SECURITY UPDATE: Infinite loop
- debian/patches/CVE-2021-37622-*.patch: adds regression test; makes sure
that read is complete to prevent infinite loop and remove dedundant
check in src/jpgimage.cpp.
- CVE-2021-37622
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2021-37623-1.patch: adds regression test.
- debian/patches/CVE-2021-37623-2.patch: adjusts bufRead after seek() to
avoid a infinite loop in src/jpgimage.cpp.
- CVE-2021-37623
* debian/patches/fix_enforce_include.patch: includes enforce in
crwimage_int.cpp.
-- Leonidas Da Silva Barbosa <email address hidden> Thu, 12 Aug 2021 13:18:13 -0300
|
| CVE-2021-32815 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The assertion failure is t |
| CVE-2021-34334 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is trigge |
| CVE-2021-34335 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception |
| CVE-2021-37615 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference |
| CVE-2021-37616 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference |
| CVE-2021-37618 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was |
| CVE-2021-37619 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was |
| CVE-2021-37620 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was |
| CVE-2021-37621 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found |
| CVE-2021-37622 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found |
| CVE-2021-37623 |
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found |
|
