This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============3544666694325140747==
Content-Language: en-CA
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------OYOQ77QogJ01DsR4r48oeWCk"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------OYOQ77QogJ01DsR4r48oeWCk
Content-Type: multipart/mixed;
 boundary="------------rd0NQTX520YXe0KNJcAy5PLe";
 protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: "ubuntu-security-announce@lists.ubuntu.com"
 <ubuntu-security-announce@lists.ubuntu.com>
Message-ID: <a7d3f159-1f9d-5b83-8494-a58ae782ca2b@canonical.com>
Subject: [USN-5483-1] Exempi vulnerabilities

--------------rd0NQTX520YXe0KNJcAy5PLe
Content-Type: text/plain; charset=UTF-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-5483-1
June 16, 2022

exempi vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 21.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in Exempi.

Software Description:
- exempi: library to parse XMP metadata

Details:

It was discovered that Exempi incorrectly handled certain media files. If a
user or automated system were tricked into opening a specially crafted
file, a remote attacker could cause Exempi to stop responding or crash,
resulting in a denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  exempi                          2.5.2-1ubuntu0.22.04.1
  libexempi8                      2.5.2-1ubuntu0.22.04.1

Ubuntu 21.10:
  exempi                          2.5.2-1ubuntu0.21.10.1
  libexempi8                      2.5.2-1ubuntu0.21.10.1

Ubuntu 20.04 LTS:
  exempi                          2.5.1-1ubuntu0.1
  libexempi8                      2.5.1-1ubuntu0.1

Ubuntu 18.04 LTS:
  exempi                          2.4.5-2ubuntu0.1
  libexempi3                      2.4.5-2ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5483-1
  CVE-2018-12648, CVE-2021-36045, CVE-2021-36046, CVE-2021-36047,
  CVE-2021-36048, CVE-2021-36050, CVE-2021-36051, CVE-2021-36052,
  CVE-2021-36053, CVE-2021-36054, CVE-2021-36055, CVE-2021-36056,
  CVE-2021-36058, CVE-2021-36064, CVE-2021-39847, CVE-2021-40716,
  CVE-2021-40732, CVE-2021-42528, CVE-2021-42529, CVE-2021-42530,
  CVE-2021-42531, CVE-2021-42532

Package Information:
  https://launchpad.net/ubuntu/+source/exempi/2.5.2-1ubuntu0.22.04.1
  https://launchpad.net/ubuntu/+source/exempi/2.5.2-1ubuntu0.21.10.1
  https://launchpad.net/ubuntu/+source/exempi/2.5.1-1ubuntu0.1
  https://launchpad.net/ubuntu/+source/exempi/2.4.5-2ubuntu0.1

--------------rd0NQTX520YXe0KNJcAy5PLe--

--------------OYOQ77QogJ01DsR4r48oeWCk
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmKrYIMACgkQZWnYVadE
vpMk0A/+PYrGYiBItyiM1l6HoFA1W3GOI0ehEYcpzsIIl/LNQgk4/HNUbxgowX8P
7rF+EafZu+tJJZqCxYu0sUVh+PYggxFkSOYHGBgc1LK1j7aAhFoIddADQlkAvnb2
OpiSDIWYbFfFILgCGC0nA22BYO7FwwcF3KBHzo46p8NI378crKvNxpWofQ7CgMou
tyzLhxW1wcapDN4Fp9BFCfHtavEBxvOvpSO9F0adEnAhd8rdW0pw9WVcxRnbtynR
BoigF/GWyUy903M4eiC9axwBkPxFL6ImcYUsfgJody80zs0ZqnB8sfXslyi1vMZl
4oiBAR2Bv9tMKm1vnGjjXCAGHp+ca9bc+P1EvkxROESOHbl7xp7lFX7H8j2jWfq7
yfrqedqg5O/rt1jKbSiuQDYH/ksWBvD4B5FV2HP3q3GIUdZWT4KSZGzEU2WEGyWC
XHeLQTx4/NY5rujRnBc4CwcjXp0cwvcMlm+LHAxUxaMVr6OrCLv3pbDYgYLda4f0
nY3fxFT6kTX4UE7k0KGuedFYvcGgEJL49h2UB7KwybpK55jzEG2NZ+/lPEz5W6Cl
c3gqBUo2NlndoHEnYMFdxkgnVzveXu1s5009SCKapDj7Dk7xWCegwhHvMO4aG8lg
NVbfBDFjgS261Dqe2P0vnSFfsF8FUpUJfodLJmtL+LU2TDnzK/E=
=nC6y
-----END PGP SIGNATURE-----

--------------OYOQ77QogJ01DsR4r48oeWCk--


--===============3544666694325140747==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

Cg==

--===============3544666694325140747==--