EulerOS 2.0 SP3 : exiv2 (EulerOS-SA-2018-1287)
Medium Nessus Plugin ID 117731
SynopsisThe remote EulerOS host is missing multiple security updates.
DescriptionAccording to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :
- Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.(CVE-2018-12265)
- Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp.(CVE-2018-12264)
Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected exiv2 packages.