发现 Exiv2 未能正确处理某些文件。攻击者可能利用此问题造成拒绝服务。
（CVE-2018-10958、CVE-2018-10998）

发现 Exiv2 未能正确处理某些 PNG 文件。攻击者可能利用此问题访问敏感信息。
(CVE-2018-10999)

发现 Exiv2 未能正确处理某些文件。攻击者可能利用此漏洞执行任意代码。
(CVE-2018-11531)

发现 Exiv2 未能正确处理某些文件。攻击者可能利用此问题访问敏感信息。
（CVE-2018-12264、CVE-2018-12265）

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

exiv2 的更新现在可用于 Red Hat Enterprise Linux 7。Red Hat 产品安全团队将此更新评级为具有低等安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。exiv2 程序包会提供一个命令行实用工具，其可显示并操控图像元数据，例如 EXIF、LPTC 和 JPEG 注解。下列程序包已升级到更高的上游版本：exiv2 (0.27.0)。(BZ#1652637) 安全修复：* exiv2：src/ iptc.cpp 的 Exiv2::IptcData::printStructure 中发生堆缓冲区溢出 (CVE-2017-17724) * exiv2：Exiv2::Internal::stringFormat image.cpp　中发生越界读取 (CVE-2018-8976) * exiv2：canonmn_int.cpp 的 Exiv2::Internal::printCsLensFFFF 函数中发生无效内存访问 (CVE-2018-8977) * exiv2：iptc.c 的 IptcData::printStructure 中发生越界读取 (CVE-2018-9305) * exiv2：pngimage.cpp:tEXtToDataBuf() 中的　OOB 读取允许通过特制的文件造成崩溃 (CVE-2018-10772) * exiv2：types.cpp:Exiv2::Internal::PngChunk::zlibUncompress() 中的内存分配造成 SIGABRT (CVE-2018-10958) * exiv2：触发不正确的 Safe::add 调用导致 SIGABRT (CVE-2018-10998) * exiv2：通过特制的文件造成信息泄露 (CVE-2018-11037) * exiv2：preview.cpp 的 getData 函数中发生整数溢出 (CVE-2018-12264) * exiv2：preview.cpp 的 LoaderExifJpeg 类别中发生整数溢出 (CVE-2018-12265) * exiv2：webpimage.cpp 的 WebPImage::decodeChunks 中发生基于堆的缓冲区过度读取 (CVE-2018-14046) * exiv2：value.cpp 的 Exiv2::DataValue::copy 中发生空指针取消引用，进而导致应用程序崩溃 (CVE-2018-17282) * exiv2：crwimage_int.cpp 的 CiffDirectory::readDirectory() 中发生堆栈溢出，进而导致拒绝服务 (CVE-2018-17581) * exiv2：image.cpp 的 Exiv2::Image::printIFDStructure 函数中发生无限循环 (CVE-2018-18915) * exiv2：iptc.cpp 的 Exiv2::IptcParser::decode 中发生基于堆的缓冲区过度读取 (CVE-2018-19107) * exiv2：psdimage.cpp 的 Exiv2::PsdImage::readMetadata 中发生无限循环 (CVE-2018-19108) * exiv2：pngchunk_int.cpp 的 PngChunk::readRawProfile 中发生基于堆的缓冲区过度读取 (CVE-2018-19535) * exiv2：easyaccess.cpp 的 Exiv2::isoSpeed 中发生空指针取消引用 (CVE-2018-19607) * exiv2：Exiv2::tEXtToDataBuf 函数中发生基于堆的缓冲区过度读取，进而导致拒绝服务 (CVE-2018-20096) * exiv2：Exiv2::Internal::TiffParserWorker::findPrimaryGroups 函数中发生分段错误 (CVE-2018-20097) * exiv2：Exiv2::Jp2Image::encodeJp2Header 中发生基于堆的缓冲区过度读取，进而导致拒绝服务 (CVE-2018-20098) * exiv2：Exiv2::Jp2Image::encodeJp2Header 中的无限循环导致拒绝服务 (CVE-2018-20099) 有关此安全问题的详细信息，包括其影响、CVSS 分数、致谢和其他相关信息，请参阅列于“参考”部分的 CVE 页面。更多变更：如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 7.7 发行说明。

远程主机受到 GLSA-201811-14 中所述漏洞的影响（Exiv2：多个漏洞）在 Exiv2 中发现多个漏洞。请检查下面引用的 CVE 标识符以了解详细信息。影响：远程攻击者可造成拒绝服务情况或通过特别构建的文件获取敏感信息。解决方法：目前无任何已知的解决方法。

This update for exiv2 fixes the following issues :

CVE-2017-11591: A floating point exception in the Exiv2::ValueType function could lead to a remote denial of service attack via crafted input. (bsc#1050257)

CVE-2017-14864: An invalid memory address dereference was discovered in Exiv2::getULong in types.cpp. The vulnerability caused a segmentation fault and application crash, which lead to denial of service. (bsc#1060995)

CVE-2017-14862: An invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp. The vulnerability caused a segmentation fault and application crash, which lead to denial of service. (bsc#1060996)

CVE-2017-14859: An invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp. The vulnerability caused a segmentation fault and application crash, which lead to denial of service. (bsc#1061000)

CVE-2017-11683: There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp that could lead to a remote denial of service attack via crafted input.
(bsc#1051188)

CVE-2017-17669: There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp. A crafted PNG file would lead to a remote denial of service attack.
(bsc#1072928)

CVE-2018-10958: In types.cpp a large size value might have lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress call. (bsc#1092952)

CVE-2018-10998: readMetadata in jp2image.cpp allowed remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call. (bsc#1093095)

CVE-2018-11531: Exiv2 had a heap-based buffer overflow in getData in preview.cpp. (bsc#1095070)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A PngChunk::parseChunkContent uncontrolled memory     allocation in Exiv2 through 0.27.1 allows an attacker     to cause a denial of service (crash due to an     std::bad_alloc exception) via a crafted PNG image     file.(CVE-2019-13112)

  - An Invalid memory address dereference was discovered in     Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The     vulnerability causes a segmentation fault and     application crash, which leads to denial of     service.(CVE-2017-14862)

  - An Invalid memory address dereference was discovered in     Exiv2::getULong in types.cpp in Exiv2 0.26. The     vulnerability causes a segmentation fault and     application crash, which leads to denial of     service.(CVE-2017-14864)

  - An Invalid memory address dereference was discovered in     Exiv2::StringValueBase::read in value.cpp in Exiv2     0.26. The vulnerability causes a segmentation fault and     application crash, which leads to denial of     service.(CVE-2017-14859)

  - An issue was discovered in Exiv2 0.26. readMetadata in     jp2image.cpp allows remote attackers to cause a denial     of service (SIGABRT) by triggering an incorrect     Safe::add call.(CVE-2018-10998)

  - An issue was discovered in Exiv2 0.26. The     Exiv2::Internal::PngChunk::parseTXTChunk function has a     heap-based buffer over-read.(CVE-2018-10999)

  - An issue was discovered in Exiv2 0.26. When the data     structure of the structure ifd is incorrect, the     program assigns pValue_ to 0x0, and the value of     pValue() is 0x0. TiffImageEntry::doWriteImage will use     the value of pValue() to cause a segmentation fault. To     exploit this vulnerability, someone must open a crafted     tiff file.(CVE-2017-9239)

  - CiffDirectory::readDirectory() at crwimage_int.cpp in     Exiv2 0.26 has excessive stack consumption due to a     recursive function, leading to Denial of     service.(CVE-2018-17581)

  - Exiv2 0.26 has a Null Pointer Dereference in the     Exiv2::DataValue::toLong function in value.cpp, related     to crafted metadata in a TIFF file.(CVE-2017-18005)

  - Exiv2 through 0.27.1 allows an attacker to cause a     denial of service (crash due to assertion failure) via     an invalid data location in a CRW image     file.(CVE-2019-13113)

  - In Exiv2 0.26 and previous versions,     PngChunk::readRawProfile in pngchunk_int.cpp may cause     a denial of service (application crash due to a     heap-based buffer over-read) via a crafted PNG     file.(CVE-2018-19535)

  - In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp     (called from psdimage.cpp in the PSD image reader) may     suffer from a denial of service (heap-based buffer     over-read) caused by an integer overflow via a crafted     PSD image file.(CVE-2018-19107)

  - In Exiv2 0.26, Exiv2::PsdImage::readMetadata in     psdimage.cpp in the PSD image reader may suffer from a     denial of service (infinite loop) caused by an integer     overflow via a crafted PSD image file.(CVE-2018-19108)

  - In types.cpp in Exiv2 0.26, a large size value may lead     to a SIGABRT during an attempt at memory allocation for     an Exiv2::Internal::PngChunk::zlibUncompress     call.(CVE-2018-10958)

  - There is a Floating point exception in the     Exiv2::ValueType function in Exiv2 0.26 that will lead     to a remote denial of service attack via crafted     input.(CVE-2017-11591)

  - There is a heap-based buffer over-read in the     Exiv2::Internal::PngChunk::keyTXTChunk function of     pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will     lead to a remote denial of service     attack.(CVE-2017-17669)

  - There is a reachable assertion in the     Internal::TiffReader::visitDirectory function in     tiffvisitor.cpp of Exiv2 0.26 that will lead to a     remote denial of service attack via crafted     input.(CVE-2017-11683)

  - There is a SEGV in     Exiv2::Internal::TiffParserWorker::findPrimaryGroups of     tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input     will lead to a remote denial of service     attack.(CVE-2018-20097)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3700-1 advisory.

    It was discovered that Exiv2 incorrectly handled certain files. An attacker could possibly use this to     cause a denial of service. (CVE-2018-10958, CVE-2018-10998)

    It was discovered that Exiv2 incorrectly handled certain PNG files. An attacker could possibly use this to     access sensitive information. (CVE-2018-10999)

    It was discovered that Exiv2 incorrectly handled certain files. An attacker could possibly use this to     execute arbitrary code. (CVE-2018-11531)

    It was discovered that Exiv2 incorrectly handled certain files. An attacker could possibly use this to     access sensitive information. (CVE-2018-12264, CVE-2018-12265)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The following packages have been upgraded to a later upstream version:
exiv2 (0.27.0).

Security Fix(es) :

  - exiv2: heap-buffer-overflow in     Exiv2::IptcData::printStructure in src/iptc.cpp     (CVE-2017-17724)

  - exiv2: out-of-bounds read in     Exiv2::Internal::stringFormat image.cpp (CVE-2018-8976)

  - exiv2: invalid memory access in     Exiv2::Internal::printCsLensFFFF function in     canonmn_int.cpp (CVE-2018-8977)

  - exiv2: out of bounds read in IptcData::printStructure in     iptc.c (CVE-2018-9305)

  - exiv2: OOB read in pngimage.cpp:tEXtToDataBuf() allows     for crash via crafted file (CVE-2018-10772)

  - exiv2: SIGABRT caused by memory allocation in     types.cpp:Exiv2::Internal::PngChunk::zlibUncompress()     (CVE-2018-10958)

  - exiv2: SIGABRT by triggering an incorrect Safe::add call     (CVE-2018-10998)

  - exiv2: information leak via a crafted file     (CVE-2018-11037)

  - exiv2: integer overflow in getData function in     preview.cpp (CVE-2018-12264)

  - exiv2: integer overflow in the LoaderExifJpeg class in     preview.cpp (CVE-2018-12265)

  - exiv2: heap-based buffer over-read in     WebPImage::decodeChunks in webpimage.cpp     (CVE-2018-14046)

  - exiv2: NULL pointer dereference in     Exiv2::DataValue::copy in value.cpp leading to     application crash (CVE-2018-17282)

  - exiv2: Stack overflow in CiffDirectory::readDirectory()     at crwimage_int.cpp leading to denial of service     (CVE-2018-17581)

  - exiv2: infinite loop in Exiv2::Image::printIFDStructure     function in image.cpp (CVE-2018-18915)

  - exiv2: heap-based buffer over-read in     Exiv2::IptcParser::decode in iptc.cpp (CVE-2018-19107)

  - exiv2: infinite loop in Exiv2::PsdImage::readMetadata in     psdimage.cpp (CVE-2018-19108)

  - exiv2: heap-based buffer over-read in     PngChunk::readRawProfile in pngchunk_int.cpp     (CVE-2018-19535)

  - exiv2: NULL pointer dereference in Exiv2::isoSpeed in     easyaccess.cpp (CVE-2018-19607)

  - exiv2: Heap-based buffer over-read in     Exiv2::tEXtToDataBuf function resulting in a denial of     service (CVE-2018-20096)

  - exiv2: Segmentation fault in     Exiv2::Internal::TiffParserWorker::findPrimaryGroups     function (CVE-2018-20097)

  - exiv2: Heap-based buffer over-read in     Exiv2::Jp2Image::encodeJp2Header resulting in a denial     of service (CVE-2018-20098)

  - exiv2: Infinite loop in Exiv2::Jp2Image::encodeJp2Header     resulting in a denial of service (CVE-2018-20099)

The remote host is affected by the vulnerability described in GLSA-201811-14 (Exiv2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Exiv2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or obtain       sensitive information via a specially crafted file.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2101 advisory.

    The exiv2 packages provide a command line utility which can display and manipulate image metadata such as     EXIF, LPTC, and JPEG comments.

    The following packages have been upgraded to a later upstream version: exiv2 (0.27.0). (BZ#1652637)

    Security Fix(es):

    * exiv2: heap-buffer-overflow in Exiv2::IptcData::printStructure in src/iptc.cpp (CVE-2017-17724)

    * exiv2: out-of-bounds read in Exiv2::Internal::stringFormat image.cpp (CVE-2018-8976)

    * exiv2: invalid memory access in Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp     (CVE-2018-8977)

    * exiv2: out of bounds read in IptcData::printStructure in iptc.c (CVE-2018-9305)

    * exiv2: OOB read in pngimage.cpp:tEXtToDataBuf() allows for crash via crafted file (CVE-2018-10772)

    * exiv2: SIGABRT caused by memory allocation in types.cpp:Exiv2::Internal::PngChunk::zlibUncompress()     (CVE-2018-10958)

    * exiv2: SIGABRT by triggering an incorrect Safe::add call (CVE-2018-10998)

    * exiv2: information leak via a crafted file (CVE-2018-11037)

    * exiv2: integer overflow in getData function in preview.cpp (CVE-2018-12264)

    * exiv2: integer overflow in the LoaderExifJpeg class in preview.cpp (CVE-2018-12265)

    * exiv2: heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp (CVE-2018-14046)

    * exiv2: NULL pointer dereference in Exiv2::DataValue::copy in value.cpp leading to application crash     (CVE-2018-17282)

    * exiv2: Stack overflow in CiffDirectory::readDirectory() at crwimage_int.cpp leading to denial of service     (CVE-2018-17581)

    * exiv2: infinite loop in Exiv2::Image::printIFDStructure function in image.cpp (CVE-2018-18915)

    * exiv2: heap-based buffer over-read in Exiv2::IptcParser::decode in iptc.cpp (CVE-2018-19107)

    * exiv2: infinite loop in Exiv2::PsdImage::readMetadata in psdimage.cpp (CVE-2018-19108)

    * exiv2: heap-based buffer over-read in PngChunk::readRawProfile in pngchunk_int.cpp (CVE-2018-19535)

    * exiv2: NULL pointer dereference in Exiv2::isoSpeed in easyaccess.cpp (CVE-2018-19607)

    * exiv2: Heap-based buffer over-read in Exiv2::tEXtToDataBuf function resulting in a denial of service     (CVE-2018-20096)

    * exiv2: Segmentation fault in Exiv2::Internal::TiffParserWorker::findPrimaryGroups function     (CVE-2018-20097)

    * exiv2: Heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header resulting in a denial of service     (CVE-2018-20098)

    * exiv2: Infinite loop in Exiv2::Jp2Image::encodeJp2Header resulting in a denial of service     (CVE-2018-20099)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
110922	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS：Exiv2 漏洞 (USN-3700-1)	Nessus	Ubuntu Local Security Checks	7/5/2018	8/27/2024	critical
127672	RHEL 7 : exiv2 (RHSA-2019:2101)	Nessus	Red Hat Local Security Checks	8/12/2019	11/6/2024	high
119134	GLSA-201811-14：Exiv2：多个漏洞	Nessus	Gentoo Local Security Checks	11/26/2018	7/19/2024	critical
119645	SUSE SLED12 / SLES12 Security Update : exiv2 (SUSE-SU-2018:3882-2)	Nessus	SuSE Local Security Checks	12/13/2018	7/16/2024	critical
132293	EulerOS 2.0 SP3 : exiv2 (EulerOS-SA-2019-2576)	Nessus	Huawei Local Security Checks	12/19/2019	4/3/2024	high
110922	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Exiv2 vulnerabilities (USN-3700-1)	Nessus	Ubuntu Local Security Checks	7/5/2018	8/27/2024	critical
128216	Scientific Linux Security Update : exiv2 on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	8/27/2019	5/1/2024	high
119134	GLSA-201811-14 : Exiv2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	11/26/2018	7/19/2024	critical
127672	RHEL 7 : exiv2 (RHSA-2019:2101)	Nessus	Red Hat Local Security Checks	8/12/2019	11/6/2024	high

Detections

Analytics

Plugins Search

critical

high

critical

critical

high

critical

high

critical

high