Mehrere Probleme in Exiv2
ID: | USN-3700-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 17.10, Ubuntu 18.04 LTS |
Datum: | Di, 3. Juli 2018, 22:51 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11531
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10958 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12265 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10999 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12264 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10998 |
Applikationen: | ExiV2 |
Originalnachricht |
|
--===============6154722254773516956== Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="=-2cZr9UH6D1PDF6MY2qKW" --=-2cZr9UH6D1PDF6MY2qKW Content-Type: text/plain; charset="UTF-8 Content-Transfer-Encoding: quoted-printable ========================================================================== Ubuntu Security Notice USN-3700-1 July 03, 2018 exiv2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Exiv2. Software Description: - exiv2: EXIF/IPTC/XMP metadata manipulation tool Details: It was discovered that Exiv2 incorrectly handled certain files. An attacker could possibly use this to cause a denial of service. (CVE-2018-10958, CVE-2018-10998) It was discovered that Exiv2 incorrectly handled certain PNG files. An attacker could possibly use this to access sensitive information. (CVE-2018-10999) It was discovered that Exiv2 incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. (CVE-2018-11531) It was discovered that Exiv2 incorrectly handled certain files. An attacker could possibly use this to access sensitive information. (CVE-2018-12264, CVE-2018-12265) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: exiv2 0.25-3.1ubuntu0.18.04.1 libexiv2-14 0.25-3.1ubuntu0.18.04.1 Ubuntu 17.10: exiv2 0.25-3.1ubuntu0.17.10.1 libexiv2-14 0.25-3.1ubuntu0.17.10.1 Ubuntu 16.04 LTS: exiv2 0.25-2.1ubuntu16.04.2 libexiv2-14 0.25-2.1ubuntu16.04.2 Ubuntu 14.04 LTS: exiv2 0.23-1ubuntu2.1 libexiv2-12 0.23-1ubuntu2.1 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/usn/usn-3700-1 CVE-2018-10958, CVE-2018-10998, CVE-2018-10999, CVE-2018-11531, CVE-2018-12264, CVE-2018-12265 Package Information: https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.18.04.1 https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.17.10.1 https://launchpad.net/ubuntu/+source/exiv2/0.25-2.1ubuntu16.04.2 https://launchpad.net/ubuntu/+source/exiv2/0.23-1ubuntu2.1 --=-2cZr9UH6D1PDF6MY2qKW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAABCAAGBQJbO7TmAAoJEEW851uECx9pME0QALwYaa3RAEZApCv55BWXf1KL DpVmXtDaHGkjOvHckMh5uZEpgnMjmDH36LXMdjNTPWmynSRt5Zw+3NBTM/eJzD5l gd/uaq/iQytwfrg8h47AfpE3VOqCKigrkqqZ7Tc3X4ISZJHLpMgdFI2cfXPXIoPm 6XZJ+wcEKfA6aiC7XM6duaNJnks+5LP+Lld5UAn3c2pfjbdp1QTzGFm86cIoYVLy ch+H+TEuTM9RqbXcfhO03n7+yfWhNQnxGzAgTid9+ttX07CnRBns6wGc6JRAwJmM GRJb5oDJALFDft/JHe5q+Z/23ytjt1W0DPh6sLQEPnNJi6cQAu+WMMNEZB4fjLGL IvG4iKd4ljEYUUb3cHIMCgl9uPZQVanruI7SgDBi7UXMRXX3g6WUEDhD/imHIxkr fwknTKpSV5MpU8Fd7dYbRt0H4QYViA4dHnLBluvmPNoUqvzZpj5QdyvBINIv0zRH 5rdU6mbA5P/rfbTacpwbZSE4b4AkU2OFVQYovKsIcSYyX4vrIV2Q1PG2ZP2rIVGR bvMAHO1O3GIUGN1Gcotu7lj+WEEcK1H9hYh1eiBm1jp+gVxfcq80HVDN91X8PJuj WowzNr8LS2tZ6hqE9MFjzvCuyBLnxR+XwUWr+eb4c39MICHPqVRisrHETpVw3eq7 i2X9Cp42rCNH8OgCJbRU =TjNU -----END PGP SIGNATURE----- --=-2cZr9UH6D1PDF6MY2qKW-- --===============6154722254773516956== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5 LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj dXJpdHktYW5ub3VuY2UK --===============6154722254773516956==-- |