Mehrere Probleme in Exiv2
ID: | USN-4056-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 18.10, Ubuntu 19.04 |
Datum: | Mo, 15. Juli 2019, 20:26 |
Referenzen: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13113
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13114 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19535 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13112 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13110 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19108 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19107 |
Applikationen: | ExiV2 |
Originalnachricht |
|
--===============0735869435554887807== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="3V7upXqbjpZ4EhLz" Content-Disposition: inline --3V7upXqbjpZ4EhLz Content-Type: text/plain; charset=us-ascii Content-Disposition: inline ========================================================================== Ubuntu Security Notice USN-4056-1 July 15, 2019 exiv2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.04 - Ubuntu 18.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Exiv2. Software Description: - exiv2: EXIF/IPTC/XMP metadata manipulation tool Details: It was discovered that Exiv2 incorrectly handled certain PSD files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-19107, CVE-2018-19108) It was discovered that Exiv2 incorrectly handled certain PNG files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-19535, CVE-2019-13112) It was discovered that Exiv2 incorrectly handled certain CRW files. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-13110, CVE-2019-13113) It was discovered that incorrectly handled certain HTTP requests. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-13114) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04: exiv2 0.25-4ubuntu1.1 libexiv2-14 0.25-4ubuntu1.1 Ubuntu 18.10: exiv2 0.25-4ubuntu0.2 libexiv2-14 0.25-4ubuntu0.2 Ubuntu 18.04 LTS: exiv2 0.25-3.1ubuntu0.18.04.3 libexiv2-14 0.25-3.1ubuntu0.18.04.3 Ubuntu 16.04 LTS: exiv2 0.25-2.1ubuntu16.04.4 libexiv2-14 0.25-2.1ubuntu16.04.4 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/4056-1 CVE-2018-19107, CVE-2018-19108, CVE-2018-19535, CVE-2019-13110, CVE-2019-13112, CVE-2019-13113, CVE-2019-13114 Package Information: https://launchpad.net/ubuntu/+source/exiv2/0.25-4ubuntu1.1 https://launchpad.net/ubuntu/+source/exiv2/0.25-4ubuntu0.2 https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.18.04.3 https://launchpad.net/ubuntu/+source/exiv2/0.25-2.1ubuntu16.04.4 --3V7upXqbjpZ4EhLz Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJdLJDsAAoJEEW851uECx9pyPAP/j3sj/R3B15H8fK/r/OVTmIi cpVkqo3TVa9Rbw71JG/Ed451uKpl2ee0LPGcRsqVBQZBX8//sPjL0oyBEhf0KZ+t IpDwVokWzYg6NrfGoTrx01bJGNqBZPYigxZtHj8pNp8pSkELYNxEMUD5KZOOng8X bEDCjeZznIFX+McPiQ8Fh+Y32W2waVaVtB7ilLeW+OqcHq7gv08our7AfbuHOQvC 5+tD4JK4iA0Xko3mUm4kKd7uMAxIA8Whq5ugOJgQ0a2hXVwWf8AD7y7ViVXQCdYm hWXZeKsUZITelJLtHCXgZMNaj+U+iOJTXS4jSDRZ6iYyPlt1EeweP+7Uvontt74h 2xnI74p67G1CqaeztlVXdbY0T9g7k+oQ0oPHYlxSyCrqaIsiOJpkI8/uyLD5zv1O Uuj/C/wGfRRK2pucX+0i0YzMMLTHS8MlynCliVyfaVyOD6p3w79kqmaRev1xUEBf HDnSVcfybUjgHw5tVTAmCvGlpzK6jrzVX/h3T/4La+amk57JS7Ju0zPk/lR2+hjI WS705KPgM3HHb6zub3FtSF6GKq2QfTx6qg1YIJ52cjVNxgrziHL1rgJEWGyKpHOy Ds3n/kZLA/EXEF7QzQG5Zm0KO3W9b97TCLykLEI4LZmouomM5+5BMl/ZyUDOZAhv WnDtXMrtJqsvcWonAYGB =dY9G -----END PGP SIGNATURE----- --3V7upXqbjpZ4EhLz-- --===============0735869435554887807== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce |