Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Exiv2
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Exiv2
ID: USN-3700-1
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 17.10, Ubuntu 18.04 LTS
Datum: Di, 3. Juli 2018, 22:51
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11531
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10958
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12265
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10999
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12264
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10998
Applikationen: ExiV2

Originalnachricht


--===============6154722254773516956==
Content-Type: multipart/signed; micalg="pgp-sha256";
protocol="application/pgp-signature";
boundary="=-2cZr9UH6D1PDF6MY2qKW"


--=-2cZr9UH6D1PDF6MY2qKW
Content-Type: text/plain; charset="UTF-8
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-3700-1
July 03, 2018

exiv2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Exiv2.

Software Description:
- exiv2: EXIF/IPTC/XMP metadata manipulation tool

Details:

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to cause a denial of service.
(CVE-2018-10958, CVE-2018-10998)

It was discovered that Exiv2 incorrectly handled certain PNG files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-10999)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to execute arbitrary code.
(CVE-2018-11531)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-12264, CVE-2018-12265)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
exiv2 0.25-3.1ubuntu0.18.04.1
libexiv2-14 0.25-3.1ubuntu0.18.04.1

Ubuntu 17.10:
exiv2 0.25-3.1ubuntu0.17.10.1
libexiv2-14 0.25-3.1ubuntu0.17.10.1

Ubuntu 16.04 LTS:
exiv2 0.25-2.1ubuntu16.04.2
libexiv2-14 0.25-2.1ubuntu16.04.2

Ubuntu 14.04 LTS:
exiv2 0.23-1ubuntu2.1
libexiv2-12 0.23-1ubuntu2.1

In general, a standard system update will make all the necessary
changes.

References:
https://usn.ubuntu.com/usn/usn-3700-1
CVE-2018-10958, CVE-2018-10998, CVE-2018-10999, CVE-2018-11531,
CVE-2018-12264, CVE-2018-12265

Package Information:
https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.18.04.1
https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.17.10.1
https://launchpad.net/ubuntu/+source/exiv2/0.25-2.1ubuntu16.04.2
https://launchpad.net/ubuntu/+source/exiv2/0.23-1ubuntu2.1
--=-2cZr9UH6D1PDF6MY2qKW
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAABCAAGBQJbO7TmAAoJEEW851uECx9pME0QALwYaa3RAEZApCv55BWXf1KL
DpVmXtDaHGkjOvHckMh5uZEpgnMjmDH36LXMdjNTPWmynSRt5Zw+3NBTM/eJzD5l
gd/uaq/iQytwfrg8h47AfpE3VOqCKigrkqqZ7Tc3X4ISZJHLpMgdFI2cfXPXIoPm
6XZJ+wcEKfA6aiC7XM6duaNJnks+5LP+Lld5UAn3c2pfjbdp1QTzGFm86cIoYVLy
ch+H+TEuTM9RqbXcfhO03n7+yfWhNQnxGzAgTid9+ttX07CnRBns6wGc6JRAwJmM
GRJb5oDJALFDft/JHe5q+Z/23ytjt1W0DPh6sLQEPnNJi6cQAu+WMMNEZB4fjLGL
IvG4iKd4ljEYUUb3cHIMCgl9uPZQVanruI7SgDBi7UXMRXX3g6WUEDhD/imHIxkr
fwknTKpSV5MpU8Fd7dYbRt0H4QYViA4dHnLBluvmPNoUqvzZpj5QdyvBINIv0zRH
5rdU6mbA5P/rfbTacpwbZSE4b4AkU2OFVQYovKsIcSYyX4vrIV2Q1PG2ZP2rIVGR
bvMAHO1O3GIUGN1Gcotu7lj+WEEcK1H9hYh1eiBm1jp+gVxfcq80HVDN91X8PJuj
WowzNr8LS2tZ6hqE9MFjzvCuyBLnxR+XwUWr+eb4c39MICHPqVRisrHETpVw3eq7
i2X9Cp42rCNH8OgCJbRU
=TjNU
-----END PGP SIGNATURE-----

--=-2cZr9UH6D1PDF6MY2qKW--



--===============6154722254773516956==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============6154722254773516956==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung