==========================================================================
Ubuntu Security Notice USN-3700-1
July 03, 2018
exiv2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 18.04 LTS
– Ubuntu 17.10
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Exiv2.
Software Description:
– exiv2: EXIF/IPTC/XMP metadata manipulation tool
Details:
It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to cause a denial of service.
(CVE-2018-10958, CVE-2018-10998)
It was discovered that Exiv2 incorrectly handled certain PNG files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-10999)
It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to execute arbitrary code.
(CVE-2018-11531)
It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-12264, CVE-2018-12265)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
exiv2 0.25-3.1ubuntu0.18.04.1
libexiv2-14 0.25-3.1ubuntu0.18.04.1
Ubuntu 17.10:
exiv2 0.25-3.1ubuntu0.17.10.1
libexiv2-14 0.25-3.1ubuntu0.17.10.1
Ubuntu 16.04 LTS:
exiv2 0.25-2.1ubuntu16.04.2
libexiv2-14 0.25-2.1ubuntu16.04.2
Ubuntu 14.04 LTS:
exiv2 0.23-1ubuntu2.1
libexiv2-12 0.23-1ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://usn.ubuntu.com/usn/usn-3700-1
CVE-2018-10958, CVE-2018-10998, CVE-2018-10999, CVE-2018-11531,
CVE-2018-12264, CVE-2018-12265
Package Information:
https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.18.04.1
https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.17.10.1
https://launchpad.net/ubuntu/+source/exiv2/0.25-2.1ubuntu16.04.2
https://launchpad.net/ubuntu/+source/exiv2/0.23-1ubuntu2.1—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2
iQIcBAABCAAGBQJbO7TmAAoJEEW851uECx9pME0QALwYaa3RAEZApCv55BWXf1KL
DpVmXtDaHGkjOvHckMh5uZEpgnMjmDH36LXMdjNTPWmynSRt5Zw+3NBTM/eJzD5l
gd/uaq/iQytwfrg8h47AfpE3VOqCKigrkqqZ7Tc3X4ISZJHLpMgdFI2cfXPXIoPm
6XZJ+wcEKfA6aiC7XM6duaNJnks+5LP+Lld5UAn3c2pfjbdp1QTzGFm86cIoYVLy
ch+H+TEuTM9RqbXcfhO03n7+yfWhNQnxGzAgTid9+ttX07CnRBns6wGc6JRAwJmM
GRJb5oDJALFDft/JHe5q+Z/23ytjt1W0DPh6sLQEPnNJi6cQAu+WMMNEZB4fjLGL
IvG4iKd4ljEYUUb3cHIMCgl9uPZQVanruI7SgDBi7UXMRXX3g6WUEDhD/imHIxkr
fwknTKpSV5MpU8Fd7dYbRt0H4QYViA4dHnLBluvmPNoUqvzZpj5QdyvBINIv0zRH
5rdU6mbA5P/rfbTacpwbZSE4b4AkU2OFVQYovKsIcSYyX4vrIV2Q1PG2ZP2rIVGR
bvMAHO1O3GIUGN1Gcotu7lj+WEEcK1H9hYh1eiBm1jp+gVxfcq80HVDN91X8PJuj
WowzNr8LS2tZ6hqE9MFjzvCuyBLnxR+XwUWr+eb4c39MICHPqVRisrHETpVw3eq7
i2X9Cp42rCNH8OgCJbRU
=TjNU
—–END PGP SIGNATURE—–
—
