--===============0735869435554887807==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
 boundary="3V7upXqbjpZ4EhLz"
Content-Disposition: inline


--3V7upXqbjpZ4EhLz
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-4056-1
July 15, 2019

exiv2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Exiv2.

Software Description:
- exiv2: EXIF/IPTC/XMP metadata manipulation tool

Details:

It was discovered that Exiv2 incorrectly handled certain PSD files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2018-19107, CVE-2018-19108)

It was discovered that Exiv2 incorrectly handled certain PNG files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2018-19535, CVE-2019-13112)

It was discovered that Exiv2 incorrectly handled certain CRW files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-13110, CVE-2019-13113)

It was discovered that incorrectly handled certain HTTP requests.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-13114)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  exiv2                           0.25-4ubuntu1.1
  libexiv2-14                     0.25-4ubuntu1.1

Ubuntu 18.10:
  exiv2                           0.25-4ubuntu0.2
  libexiv2-14                     0.25-4ubuntu0.2

Ubuntu 18.04 LTS:
  exiv2                           0.25-3.1ubuntu0.18.04.3
  libexiv2-14                     0.25-3.1ubuntu0.18.04.3

Ubuntu 16.04 LTS:
  exiv2                           0.25-2.1ubuntu16.04.4
  libexiv2-14                     0.25-2.1ubuntu16.04.4

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/4056-1
  CVE-2018-19107, CVE-2018-19108, CVE-2018-19535, CVE-2019-13110,
  CVE-2019-13112, CVE-2019-13113, CVE-2019-13114

Package Information:
  https://launchpad.net/ubuntu/+source/exiv2/0.25-4ubuntu1.1
  https://launchpad.net/ubuntu/+source/exiv2/0.25-4ubuntu0.2
  https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.18.04.3
  https://launchpad.net/ubuntu/+source/exiv2/0.25-2.1ubuntu16.04.4

--3V7upXqbjpZ4EhLz
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJdLJDsAAoJEEW851uECx9pyPAP/j3sj/R3B15H8fK/r/OVTmIi
cpVkqo3TVa9Rbw71JG/Ed451uKpl2ee0LPGcRsqVBQZBX8//sPjL0oyBEhf0KZ+t
IpDwVokWzYg6NrfGoTrx01bJGNqBZPYigxZtHj8pNp8pSkELYNxEMUD5KZOOng8X
bEDCjeZznIFX+McPiQ8Fh+Y32W2waVaVtB7ilLeW+OqcHq7gv08our7AfbuHOQvC
5+tD4JK4iA0Xko3mUm4kKd7uMAxIA8Whq5ugOJgQ0a2hXVwWf8AD7y7ViVXQCdYm
hWXZeKsUZITelJLtHCXgZMNaj+U+iOJTXS4jSDRZ6iYyPlt1EeweP+7Uvontt74h
2xnI74p67G1CqaeztlVXdbY0T9g7k+oQ0oPHYlxSyCrqaIsiOJpkI8/uyLD5zv1O
Uuj/C/wGfRRK2pucX+0i0YzMMLTHS8MlynCliVyfaVyOD6p3w79kqmaRev1xUEBf
HDnSVcfybUjgHw5tVTAmCvGlpzK6jrzVX/h3T/4La+amk57JS7Ju0zPk/lR2+hjI
WS705KPgM3HHb6zub3FtSF6GKq2QfTx6qg1YIJ52cjVNxgrziHL1rgJEWGyKpHOy
Ds3n/kZLA/EXEF7QzQG5Zm0KO3W9b97TCLykLEI4LZmouomM5+5BMl/ZyUDOZAhv
WnDtXMrtJqsvcWonAYGB
=dY9G
-----END PGP SIGNATURE-----

--3V7upXqbjpZ4EhLz--


--===============0735869435554887807==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce