Debian Exiv2 vulnerabilities

CVE-2019-14370 [MEDIUM] CVE-2019-14370: exiv2 - In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetad... In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result in denial of service. Scope: local bookworm: resolved (fixed in 0.27.2-6) bullseye: resolved (fixed in 0.27.2-6) forky: resolved (fixed in 0.27.2-6) sid: resolved (fixed in 0.27.2-6) trixie: resolved (fixed in 0.27.2-6)

CVE-2019-14368 [HIGH] CVE-2019-14368: exiv2 - Exiv2 0.27.99.0 has a heap-based buffer over-read in Exiv2::RafImage::readMetada... Exiv2 0.27.99.0 has a heap-based buffer over-read in Exiv2::RafImage::readMetadata() in rafimage.cpp. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2019-13114 [MEDIUM] CVE-2019-13114: exiv2 - http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial ... http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character. Scope: local bookworm: resolved (fixed in 0.27.2-6) bullseye: resolved (fixed in 0.27.2-6) forky: resolved (fixed in 0.27.2-6) sid: resolved (fixed in 0.27.2-6) trixie: reso

CVE-2019-14982 [MEDIUM] CVE-2019-14982: exiv2 - In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPI... In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. It can lead to a buffer overflow vulnerability and a crash. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2019-13113 [MEDIUM] CVE-2019-13113: exiv2 - Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due ... Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file. Scope: local bookworm: resolved (fixed in 0.27.2-6) bullseye: resolved (fixed in 0.27.2-6) forky: resolved (fixed in 0.27.2-6) sid: resolved (fixed in 0.27.2-6) trixie: resolved (fixed in 0.27.2-6)

CVE-2019-13110 [MEDIUM] CVE-2019-13110: exiv2 - A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 ... A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file. Scope: local bookworm: resolved (fixed in 0.27.2-6) bullseye: resolved (fixed in 0.27.2-6) forky: resolved (fixed in 0.27.2-6) sid: resolved (fixed in 0.27.2-6) trixie: resolved (fixed

CVE-2019-20421 [HIGH] CVE-2019-20421: exiv2 - In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can r... In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file. Scope: local bookworm: resolved (fixed in 0.27.2-8) bullseye: resolved (fixed in 0.27.2-8) forky: resolved (fixed in 0.27.2-8)

CVE-2019-13112 [MEDIUM] CVE-2019-13112: exiv2 - A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.... A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file. Scope: local bookworm: resolved (fixed in 0.27.2-6) bullseye: resolved (fixed in 0.27.2-6) forky: resolved (fixed in 0.27.2-6) sid: resolved (fixed in 0.27.2-6) t

CVE-2019-13108 [MEDIUM] CVE-2019-13108: exiv2 - An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial... An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset. Scope: local bookworm: resolved (fixed in 0.27.2-6) bullseye: resolved (fixed in 0.27.2-6) forky: resolved (fixed in 0.27.2-6) sid: resolved (fixed in 0.27.2-6) trixi

CVE-2019-9144 [HIGH] CVE-2019-9144: exiv2 - An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffIma... An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. Scope: local bookworm: resolved (fixed in 0.27.2-8) bullseye: resolved (fixed in 0.27.2-8) fork

CVE-2019-13109 [MEDIUM] CVE-2019-13109: exiv2 - An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial... An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a chunkLength - iccOffset subtraction. Scope: local bookworm: resolved (fixed in 0.27.2-6) bullseye: resolved (fixed in 0.27.2-6) forky: resolved (fixed in 0.27.2-6) sid: resolved (fixed in 0.27

CVE-2019-13504 [MEDIUM] CVE-2019-13504: exiv2 - There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp ... There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2. Scope: local bookworm: resolved (fixed in 0.27.2-6) bullseye: resolved (fixed in 0.27.2-6) forky: resolved (fixed in 0.27.2-6) sid: resolved (fixed in 0.27.2-6) trixie: resolved (fixed in 0.27.2-6)

CVE-2019-9143 [HIGH] CVE-2019-9143: exiv2 - An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Ima... An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. Scope: local bookworm: resolved (fixed in 0.27.2-8) bullseye: resolved (fixed in 0.27.2-8) f

CVE-2019-13111 [MEDIUM] CVE-2019-13111: exiv2 - A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an att... A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2018-11531 [CRITICAL] CVE-2018-11531: exiv2 - Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. Scope: local bookworm: resolved (fixed in 0.25-4) bullseye: resolved (fixed in 0.25-4) forky: resolved (fixed in 0.25-4) sid: resolved (fixed in 0.25-4) trixie: resolved (fixed in 0.25-4)

CVE-2018-12265 [HIGH] CVE-2018-12265: exiv2 - Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, l... Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp. Scope: local bookworm: resolved (fixed in 0.25-4) bullseye: resolved (fixed in 0.25-4) forky: resolved (fixed in 0.25-4) sid: resolved (fixed in 0.25-4) trixie: resolved (fixed in 0.25-4)

CVE-2018-12264 [HIGH] CVE-2018-12264: exiv2 - Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leadin... Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp. Scope: local bookworm: resolved (fixed in 0.25-4) bullseye: resolved (fixed in 0.25-4) forky: resolved (fixed in 0.25-4) sid: resolved (fixed in 0.25-4) trixie: resolved (fixed in 0.25-4)

CVE-2018-19108 [MEDIUM] CVE-2018-19108: exiv2 - In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image re... In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file. Scope: local bookworm: resolved (fixed in 0.27.2-6) bullseye: resolved (fixed in 0.27.2-6) forky: resolved (fixed in 0.27.2-6) sid: resolved (fixed in 0.27.2-6) trixie: re

CVE-2018-10958 [MEDIUM] CVE-2018-10958: exiv2 - In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an a... In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call. Scope: local bookworm: resolved (fixed in 0.25-4) bullseye: resolved (fixed in 0.25-4) forky: resolved (fixed in 0.25-4) sid: resolved (fixed in 0.25-4) trixie: resolved (fixed in 0.25-4)

CVE-2018-10998 [MEDIUM] CVE-2018-10998: exiv2 - An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remot... An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call. Scope: local bookworm: resolved (fixed in 0.25-4) bullseye: resolved (fixed in 0.25-4) forky: resolved (fixed in 0.25-4) sid: resolved (fixed in 0.25-4) trixie: resolved (fixed in 0.25-4)