Vulnerability-Lookup

SUSE-SU-2022:4208-1

Vulnerability from csaf_suse - Published: 2022-11-23 16:36 - Updated: 2022-11-23 16:36

Summary

Security update for exiv2-0_26

Severity

Important

Notes

Title of the patch: Security update for exiv2-0_26

Description of the patch: This update for exiv2-0_26 fixes the following issues: - CVE-2019-17402: Fixed improper validation of the total size to the offset and size leads to a crash in Exiv2::getULong in types.cpp (bsc#1153577). - CVE-2018-20098: Fixed a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header (bsc#1119560). - CVE-2018-17581: Fixed an excessive stack consumption CiffDirectory:readDirectory() at crwimage_int.cpp (bsc#1110282). - CVE-2018-20099: exiv2: infinite loop in Exiv2::Jp2Image::encodeJp2Header (bsc#1119559). - CVE-2018-20097: Fixed SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroupsu (bsc#1119562). - CVE-2017-11591: Fixed a floating point exception in Exiv2::ValueType (bsc#1050257). - CVE-2018-11531: Fixed a heap-based buffer overflow in getData in preview.cpp (bsc#1095070). - CVE-2021-32815: Fixed a deny-of-service due to assertion failure in crwimage_int.cpp (bsc#1189337). - CVE-2021-29473: Fixed out-of-bounds read in Exiv2::Jp2Image:doWriteMetadata (bsc#1186231). - CVE-2019-13109: Fixed a denial of service in PngImage:readMetadata (bsc#1142677). - CVE-2019-13110: Fixed an integer-overflow and out-of-bounds read in CiffDirectory:readDirectory leads to denail of service (bsc#1142678).

Patchnames: SUSE-2022-4208,SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-4208,openSUSE-SLE-15.4-2022-4208

CVE-2017-11591

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2018-11531

5.3 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact moderate

CVE-2018-17581

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact low

CVE-2018-20097

4 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact moderate

CVE-2018-20098

4 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact moderate

CVE-2018-20099

4 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact moderate

CVE-2019-13109

4.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact moderate

CVE-2019-13110

4.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact moderate

CVE-2019-17402

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact low

CVE-2021-29473

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact moderate

CVE-2021-32815

3.1 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 9 products, the same list as for CVE-2017-11591

Threats

Impact low

References

51 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1050257	self
https://bugzilla.suse.com/1095070	self
https://bugzilla.suse.com/1110282	self
https://bugzilla.suse.com/1119559	self
https://bugzilla.suse.com/1119560	self
https://bugzilla.suse.com/1119562	self
https://bugzilla.suse.com/1142677	self
https://bugzilla.suse.com/1142678	self
https://bugzilla.suse.com/1153577	self
https://bugzilla.suse.com/1186231	self
https://bugzilla.suse.com/1189337	self
https://www.suse.com/security/cve/CVE-2017-11591/	self
https://www.suse.com/security/cve/CVE-2018-11531/	self
https://www.suse.com/security/cve/CVE-2018-17581/	self
https://www.suse.com/security/cve/CVE-2018-20097/	self
https://www.suse.com/security/cve/CVE-2018-20098/	self
https://www.suse.com/security/cve/CVE-2018-20099/	self
https://www.suse.com/security/cve/CVE-2019-13109/	self
https://www.suse.com/security/cve/CVE-2019-13110/	self
https://www.suse.com/security/cve/CVE-2019-17402/	self
https://www.suse.com/security/cve/CVE-2021-29473/	self
https://www.suse.com/security/cve/CVE-2021-32815/	self
https://www.suse.com/security/cve/CVE-2017-11591	external
https://bugzilla.suse.com/1050257	external
https://bugzilla.suse.com/1061023	external
https://bugzilla.suse.com/1061025	external
https://bugzilla.suse.com/1068871	external
https://www.suse.com/security/cve/CVE-2018-11531	external
https://bugzilla.suse.com/1095070	external
https://www.suse.com/security/cve/CVE-2018-17581	external
https://bugzilla.suse.com/1110282	external
https://www.suse.com/security/cve/CVE-2018-20097	external
https://bugzilla.suse.com/1119562	external
https://www.suse.com/security/cve/CVE-2018-20098	external
https://bugzilla.suse.com/1119560	external
https://www.suse.com/security/cve/CVE-2018-20099	external
https://bugzilla.suse.com/1119559	external
https://www.suse.com/security/cve/CVE-2019-13109	external
https://bugzilla.suse.com/1142677	external
https://www.suse.com/security/cve/CVE-2019-13110	external
https://bugzilla.suse.com/1142678	external
https://www.suse.com/security/cve/CVE-2019-17402	external
https://bugzilla.suse.com/1153577	external
https://www.suse.com/security/cve/CVE-2021-29473	external
https://bugzilla.suse.com/1186231	external
https://www.suse.com/security/cve/CVE-2021-32815	external
https://bugzilla.suse.com/1189337	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for exiv2-0_26",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for exiv2-0_26 fixes the following issues:\n\n- CVE-2019-17402: Fixed improper validation of the total size to the offset and size leads to a crash in Exiv2::getULong in types.cpp (bsc#1153577).\n- CVE-2018-20098: Fixed a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header (bsc#1119560).\n- CVE-2018-17581: Fixed an excessive stack consumption CiffDirectory:readDirectory() at crwimage_int.cpp (bsc#1110282).\n- CVE-2018-20099: exiv2: infinite loop in Exiv2::Jp2Image::encodeJp2Header (bsc#1119559).\n- CVE-2018-20097: Fixed SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroupsu (bsc#1119562).\n- CVE-2017-11591: Fixed a floating point exception in Exiv2::ValueType (bsc#1050257).\n- CVE-2018-11531: Fixed a heap-based buffer overflow in getData in preview.cpp (bsc#1095070).\n- CVE-2021-32815: Fixed a deny-of-service due to assertion failure in crwimage_int.cpp (bsc#1189337).\n- CVE-2021-29473: Fixed out-of-bounds read in Exiv2::Jp2Image:doWriteMetadata (bsc#1186231).\n- CVE-2019-13109: Fixed a denial of service in PngImage:readMetadata (bsc#1142677).\n- CVE-2019-13110: Fixed an integer-overflow and out-of-bounds read in CiffDirectory:readDirectory leads to denail of service (bsc#1142678).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2022-4208,SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-4208,openSUSE-SLE-15.4-2022-4208",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_4208-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2022:4208-1",
        "url": "https://www.suse.com/support/update/announcement/2022/suse-su-20224208-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2022:4208-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/013101.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1050257",
        "url": "https://bugzilla.suse.com/1050257"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1095070",
        "url": "https://bugzilla.suse.com/1095070"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1110282",
        "url": "https://bugzilla.suse.com/1110282"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1119559",
        "url": "https://bugzilla.suse.com/1119559"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1119560",
        "url": "https://bugzilla.suse.com/1119560"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1119562",
        "url": "https://bugzilla.suse.com/1119562"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1142677",
        "url": "https://bugzilla.suse.com/1142677"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1142678",
        "url": "https://bugzilla.suse.com/1142678"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1153577",
        "url": "https://bugzilla.suse.com/1153577"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1186231",
        "url": "https://bugzilla.suse.com/1186231"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1189337",
        "url": "https://bugzilla.suse.com/1189337"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-11591 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-11591/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-11531 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-11531/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-17581 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-17581/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20097 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20097/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20098 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20098/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20099 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20099/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-13109 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-13109/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-13110 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-13110/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-17402 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-17402/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-29473 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-29473/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-32815 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-32815/"
      }
    ],
    "title": "Security update for exiv2-0_26",
    "tracking": {
      "current_release_date": "2022-11-23T16:36:27Z",
      "generator": {
        "date": "2022-11-23T16:36:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2022:4208-1",
      "initial_release_date": "2022-11-23T16:36:27Z",
      "revision_history": [
        {
          "date": "2022-11-23T16:36:27Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libexiv2-26-0.26-150400.9.21.1.aarch64",
                "product": {
                  "name": "libexiv2-26-0.26-150400.9.21.1.aarch64",
                  "product_id": "libexiv2-26-0.26-150400.9.21.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libexiv2-26-64bit-0.26-150400.9.21.1.aarch64_ilp32",
                "product": {
                  "name": "libexiv2-26-64bit-0.26-150400.9.21.1.aarch64_ilp32",
                  "product_id": "libexiv2-26-64bit-0.26-150400.9.21.1.aarch64_ilp32"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64_ilp32"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libexiv2-26-0.26-150400.9.21.1.i586",
                "product": {
                  "name": "libexiv2-26-0.26-150400.9.21.1.i586",
                  "product_id": "libexiv2-26-0.26-150400.9.21.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libexiv2-26-0.26-150400.9.21.1.ppc64le",
                "product": {
                  "name": "libexiv2-26-0.26-150400.9.21.1.ppc64le",
                  "product_id": "libexiv2-26-0.26-150400.9.21.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libexiv2-26-0.26-150400.9.21.1.s390x",
                "product": {
                  "name": "libexiv2-26-0.26-150400.9.21.1.s390x",
                  "product_id": "libexiv2-26-0.26-150400.9.21.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libexiv2-26-0.26-150400.9.21.1.x86_64",
                "product": {
                  "name": "libexiv2-26-0.26-150400.9.21.1.x86_64",
                  "product_id": "libexiv2-26-0.26-150400.9.21.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libexiv2-26-32bit-0.26-150400.9.21.1.x86_64",
                "product": {
                  "name": "libexiv2-26-32bit-0.26-150400.9.21.1.x86_64",
                  "product_id": "libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
                  "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-desktop-applications:15:sp4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4",
                "product": {
                  "name": "openSUSE Leap 15.4",
                  "product_id": "openSUSE Leap 15.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexiv2-26-0.26-150400.9.21.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64"
        },
        "product_reference": "libexiv2-26-0.26-150400.9.21.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexiv2-26-0.26-150400.9.21.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le"
        },
        "product_reference": "libexiv2-26-0.26-150400.9.21.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexiv2-26-0.26-150400.9.21.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x"
        },
        "product_reference": "libexiv2-26-0.26-150400.9.21.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexiv2-26-0.26-150400.9.21.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
          "product_id": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64"
        },
        "product_reference": "libexiv2-26-0.26-150400.9.21.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Desktop Applications 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexiv2-26-0.26-150400.9.21.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64"
        },
        "product_reference": "libexiv2-26-0.26-150400.9.21.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexiv2-26-0.26-150400.9.21.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le"
        },
        "product_reference": "libexiv2-26-0.26-150400.9.21.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexiv2-26-0.26-150400.9.21.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x"
        },
        "product_reference": "libexiv2-26-0.26-150400.9.21.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexiv2-26-0.26-150400.9.21.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64"
        },
        "product_reference": "libexiv2-26-0.26-150400.9.21.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libexiv2-26-32bit-0.26-150400.9.21.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        },
        "product_reference": "libexiv2-26-32bit-0.26-150400.9.21.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-11591",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-11591"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-11591",
          "url": "https://www.suse.com/security/cve/CVE-2017-11591"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1050257 for CVE-2017-11591",
          "url": "https://bugzilla.suse.com/1050257"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1061023 for CVE-2017-11591",
          "url": "https://bugzilla.suse.com/1061023"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1061025 for CVE-2017-11591",
          "url": "https://bugzilla.suse.com/1061025"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1068871 for CVE-2017-11591",
          "url": "https://bugzilla.suse.com/1068871"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-11591"
    },
    {
      "cve": "CVE-2018-11531",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-11531"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-11531",
          "url": "https://www.suse.com/security/cve/CVE-2018-11531"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1095070 for CVE-2018-11531",
          "url": "https://bugzilla.suse.com/1095070"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-11531"
    },
    {
      "cve": "CVE-2018-17581",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-17581"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-17581",
          "url": "https://www.suse.com/security/cve/CVE-2018-17581"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1110282 for CVE-2018-17581",
          "url": "https://bugzilla.suse.com/1110282"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-17581"
    },
    {
      "cve": "CVE-2018-20097",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20097"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20097",
          "url": "https://www.suse.com/security/cve/CVE-2018-20097"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1119562 for CVE-2018-20097",
          "url": "https://bugzilla.suse.com/1119562"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20097"
    },
    {
      "cve": "CVE-2018-20098",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20098"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20098",
          "url": "https://www.suse.com/security/cve/CVE-2018-20098"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1119560 for CVE-2018-20098",
          "url": "https://bugzilla.suse.com/1119560"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20098"
    },
    {
      "cve": "CVE-2018-20099",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20099"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20099",
          "url": "https://www.suse.com/security/cve/CVE-2018-20099"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1119559 for CVE-2018-20099",
          "url": "https://bugzilla.suse.com/1119559"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20099"
    },
    {
      "cve": "CVE-2019-13109",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-13109"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a chunkLength - iccOffset subtraction.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-13109",
          "url": "https://www.suse.com/security/cve/CVE-2019-13109"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1142677 for CVE-2019-13109",
          "url": "https://bugzilla.suse.com/1142677"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-13109"
    },
    {
      "cve": "CVE-2019-13110",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-13110"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-13110",
          "url": "https://www.suse.com/security/cve/CVE-2019-13110"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1142678 for CVE-2019-13110",
          "url": "https://bugzilla.suse.com/1142678"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-13110"
    },
    {
      "cve": "CVE-2019-17402",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-17402"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-17402",
          "url": "https://www.suse.com/security/cve/CVE-2019-17402"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1153577 for CVE-2019-17402",
          "url": "https://bugzilla.suse.com/1153577"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "low"
        }
      ],
      "title": "CVE-2019-17402"
    },
    {
      "cve": "CVE-2021-29473",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-29473"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4. Please see our security policy for information about Exiv2 security.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-29473",
          "url": "https://www.suse.com/security/cve/CVE-2021-29473"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1186231 for CVE-2021-29473",
          "url": "https://bugzilla.suse.com/1186231"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-29473"
    },
    {
      "cve": "CVE-2021-32815",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-32815"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The assertion failure is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when modifying the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `fi`. ### Patches The bug is fixed in version v0.27.5. ### References Regression test and bug fix: #1739 ### For more information Please see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
          "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
          "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-32815",
          "url": "https://www.suse.com/security/cve/CVE-2021-32815"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1189337 for CVE-2021-32815",
          "url": "https://bugzilla.suse.com/1189337"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.aarch64",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.ppc64le",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.s390x",
            "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.21.1.x86_64",
            "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.21.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2022-11-23T16:36:27Z",
          "details": "low"
        }
      ],
      "title": "CVE-2021-32815"
    }
  ]
}

CVE-2017-11591 (GCVE-0-2017-11591)

Vulnerability from cvelistv5 – Published: 2017-07-24 00:00 – Updated: 2024-08-05 18:12

Summary

There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

3 references

URL	Tags
https://usn.ubuntu.com/3852-1/	vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1473888
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Date Public

2017-07-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:12:40.459Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3852-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3852-1/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1473888"
          },
          {
            "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-07-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-10T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3852-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/3852-1/"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1473888"
        },
        {
          "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-11591",
    "datePublished": "2017-07-24T00:00:00.000Z",
    "dateReserved": "2017-07-23T00:00:00.000Z",
    "dateUpdated": "2024-08-05T18:12:40.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-11531 (GCVE-0-2018-11531)

Vulnerability from cvelistv5 – Published: 2018-05-29 07:00 – Updated: 2024-08-05 08:10

Summary

Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/Exiv2/exiv2/issues/283	x_refsource_CONFIRM
https://usn.ubuntu.com/3700-1/	vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4238	vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/201811-14	vendor-advisoryx_refsource_GENTOO
https://lists.debian.org/debian-lts-announce/2018…	mailing-listx_refsource_MLIST

Date Public

2018-05-29 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:10:14.568Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/issues/283"
          },
          {
            "name": "USN-3700-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3700-1/"
          },
          {
            "name": "DSA-4238",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4238"
          },
          {
            "name": "GLSA-201811-14",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201811-14"
          },
          {
            "name": "[debian-lts-announce] 20180628 [SECURITY] [DLA 1402-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-05-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-25T10:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Exiv2/exiv2/issues/283"
        },
        {
          "name": "USN-3700-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3700-1/"
        },
        {
          "name": "DSA-4238",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4238"
        },
        {
          "name": "GLSA-201811-14",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201811-14"
        },
        {
          "name": "[debian-lts-announce] 20180628 [SECURITY] [DLA 1402-1] exiv2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-11531",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/Exiv2/exiv2/issues/283",
              "refsource": "CONFIRM",
              "url": "https://github.com/Exiv2/exiv2/issues/283"
            },
            {
              "name": "USN-3700-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3700-1/"
            },
            {
              "name": "DSA-4238",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4238"
            },
            {
              "name": "GLSA-201811-14",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201811-14"
            },
            {
              "name": "[debian-lts-announce] 20180628 [SECURITY] [DLA 1402-1] exiv2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-11531",
    "datePublished": "2018-05-29T07:00:00.000Z",
    "dateReserved": "2018-05-29T00:00:00.000Z",
    "dateUpdated": "2024-08-05T08:10:14.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-17581 (GCVE-0-2018-17581)

Vulnerability from cvelistv5 – Published: 2018-09-28 00:00 – Updated: 2024-08-05 10:54

Summary

CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/Exiv2/exiv2/issues/460
https://lists.debian.org/debian-lts-announce/2019…	mailing-list
https://usn.ubuntu.com/3852-1/	vendor-advisory
https://github.com/SegfaultMasters/covering360/bl…
https://access.redhat.com/errata/RHSA-2019:2101	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Date Public

2018-09-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:54:09.248Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/issues/460"
          },
          {
            "name": "[debian-lts-announce] 20190226 [SECURITY] [DLA 1691-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html"
          },
          {
            "name": "USN-3852-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3852-1/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/SegfaultMasters/covering360/blob/master/Exiv2"
          },
          {
            "name": "RHSA-2019:2101",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2101"
          },
          {
            "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-09-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-10T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/Exiv2/exiv2/issues/460"
        },
        {
          "name": "[debian-lts-announce] 20190226 [SECURITY] [DLA 1691-1] exiv2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html"
        },
        {
          "name": "USN-3852-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/3852-1/"
        },
        {
          "url": "https://github.com/SegfaultMasters/covering360/blob/master/Exiv2"
        },
        {
          "name": "RHSA-2019:2101",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2101"
        },
        {
          "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-17581",
    "datePublished": "2018-09-28T00:00:00.000Z",
    "dateReserved": "2018-09-28T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:54:09.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-20097 (GCVE-0-2018-20097)

Vulnerability from cvelistv5 – Published: 2018-12-12 00:00 – Updated: 2024-08-05 11:51

Summary

There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

6 references

URL	Tags
https://lists.debian.org/debian-lts-announce/2019…	mailing-list
https://github.com/Exiv2/exiv2/issues/590
https://github.com/TeamSeri0us/pocs/tree/master/e…
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2101	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Date Public

2018-12-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:18.966Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20190226 [SECURITY] [DLA 1691-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/issues/590"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206"
          },
          {
            "name": "FEDORA-2019-c9cbbbb5c0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/"
          },
          {
            "name": "RHSA-2019:2101",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2101"
          },
          {
            "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-10T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20190226 [SECURITY] [DLA 1691-1] exiv2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html"
        },
        {
          "url": "https://github.com/Exiv2/exiv2/issues/590"
        },
        {
          "url": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206"
        },
        {
          "name": "FEDORA-2019-c9cbbbb5c0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/"
        },
        {
          "name": "RHSA-2019:2101",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2101"
        },
        {
          "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-20097",
    "datePublished": "2018-12-12T00:00:00.000Z",
    "dateReserved": "2018-12-12T00:00:00.000Z",
    "dateUpdated": "2024-08-05T11:51:18.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-20098 (GCVE-0-2018-20098)

Vulnerability from cvelistv5 – Published: 2018-12-12 08:00 – Updated: 2024-08-05 11:51

Summary

There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Exiv2/exiv2/issues/590	x_refsource_MISC
https://github.com/TeamSeri0us/pocs/tree/master/e…	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://access.redhat.com/errata/RHSA-2019:2101	vendor-advisoryx_refsource_REDHAT

Date Public

2018-12-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:19.064Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/issues/590"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206"
          },
          {
            "name": "FEDORA-2019-c9cbbbb5c0",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/"
          },
          {
            "name": "RHSA-2019:2101",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2101"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-06T16:06:14.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/issues/590"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206"
        },
        {
          "name": "FEDORA-2019-c9cbbbb5c0",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/"
        },
        {
          "name": "RHSA-2019:2101",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2101"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-20098",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/Exiv2/exiv2/issues/590",
              "refsource": "MISC",
              "url": "https://github.com/Exiv2/exiv2/issues/590"
            },
            {
              "name": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206",
              "refsource": "MISC",
              "url": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206"
            },
            {
              "name": "FEDORA-2019-c9cbbbb5c0",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/"
            },
            {
              "name": "RHSA-2019:2101",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2101"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-20098",
    "datePublished": "2018-12-12T08:00:00.000Z",
    "dateReserved": "2018-12-12T00:00:00.000Z",
    "dateUpdated": "2024-08-05T11:51:19.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-20099 (GCVE-0-2018-20099)

Vulnerability from cvelistv5 – Published: 2018-12-12 08:00 – Updated: 2024-08-05 11:51

Summary

There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Exiv2/exiv2/issues/590	x_refsource_MISC
https://github.com/TeamSeri0us/pocs/tree/master/e…	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://access.redhat.com/errata/RHSA-2019:2101	vendor-advisoryx_refsource_REDHAT

Date Public

2018-12-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:51:19.045Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/issues/590"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206"
          },
          {
            "name": "FEDORA-2019-c9cbbbb5c0",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/"
          },
          {
            "name": "RHSA-2019:2101",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:2101"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-12-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-06T16:06:14.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/issues/590"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206"
        },
        {
          "name": "FEDORA-2019-c9cbbbb5c0",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/"
        },
        {
          "name": "RHSA-2019:2101",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:2101"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-20099",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/Exiv2/exiv2/issues/590",
              "refsource": "MISC",
              "url": "https://github.com/Exiv2/exiv2/issues/590"
            },
            {
              "name": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206",
              "refsource": "MISC",
              "url": "https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206"
            },
            {
              "name": "FEDORA-2019-c9cbbbb5c0",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/"
            },
            {
              "name": "RHSA-2019:2101",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:2101"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-20099",
    "datePublished": "2018-12-12T08:00:00.000Z",
    "dateReserved": "2018-12-12T00:00:00.000Z",
    "dateUpdated": "2024-08-05T11:51:19.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-13109 (GCVE-0-2019-13109)

Vulnerability from cvelistv5 – Published: 2019-06-30 22:20 – Updated: 2024-08-04 23:41

Summary

An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a chunkLength - iccOffset subtraction.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Exiv2/exiv2/issues/790	x_refsource_MISC
https://github.com/Exiv2/exiv2/pull/795	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:41:10.436Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/issues/790"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/pull/795"
          },
          {
            "name": "FEDORA-2019-60553d5a18",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a chunkLength - iccOffset subtraction."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-09T02:06:06.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/issues/790"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Exiv2/exiv2/pull/795"
        },
        {
          "name": "FEDORA-2019-60553d5a18",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-13109",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a chunkLength - iccOffset subtraction."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/Exiv2/exiv2/issues/790",
              "refsource": "MISC",
              "url": "https://github.com/Exiv2/exiv2/issues/790"
            },
            {
              "name": "https://github.com/Exiv2/exiv2/pull/795",
              "refsource": "MISC",
              "url": "https://github.com/Exiv2/exiv2/pull/795"
            },
            {
              "name": "FEDORA-2019-60553d5a18",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-13109",
    "datePublished": "2019-06-30T22:20:02.000Z",
    "dateReserved": "2019-06-30T00:00:00.000Z",
    "dateUpdated": "2024-08-04T23:41:10.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-13110 (GCVE-0-2019-13110)

Vulnerability from cvelistv5 – Published: 2019-06-30 00:00 – Updated: 2024-08-04 23:41

Summary

A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/Exiv2/exiv2/issues/843
https://github.com/Exiv2/exiv2/pull/844
https://usn.ubuntu.com/4056-1/	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:41:10.432Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/issues/843"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/pull/844"
          },
          {
            "name": "USN-4056-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4056-1/"
          },
          {
            "name": "FEDORA-2019-60553d5a18",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/"
          },
          {
            "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted CRW image file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-10T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/Exiv2/exiv2/issues/843"
        },
        {
          "url": "https://github.com/Exiv2/exiv2/pull/844"
        },
        {
          "name": "USN-4056-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4056-1/"
        },
        {
          "name": "FEDORA-2019-60553d5a18",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/"
        },
        {
          "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-13110",
    "datePublished": "2019-06-30T00:00:00.000Z",
    "dateReserved": "2019-06-30T00:00:00.000Z",
    "dateUpdated": "2024-08-04T23:41:10.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-17402 (GCVE-0-2019-17402)

Vulnerability from cvelistv5 – Published: 2019-10-09 00:00 – Updated: 2024-08-05 01:40

Summary

Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2325 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/Exiv2/exiv2/issues/1019
https://usn.ubuntu.com/4159-1/	vendor-advisory
https://lists.debian.org/debian-lts-announce/2019…	mailing-list
https://lists.debian.org/debian-lts-announce/2023…	mailing-list

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:40:15.736Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/issues/1019"
          },
          {
            "name": "USN-4159-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4159-1/"
          },
          {
            "name": "[debian-lts-announce] 20191202 [SECURITY] [DLA 2019-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00001.html"
          },
          {
            "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-10T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/Exiv2/exiv2/issues/1019"
        },
        {
          "name": "USN-4159-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4159-1/"
        },
        {
          "name": "[debian-lts-announce] 20191202 [SECURITY] [DLA 2019-1] exiv2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00001.html"
        },
        {
          "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-17402",
    "datePublished": "2019-10-09T00:00:00.000Z",
    "dateReserved": "2019-10-09T00:00:00.000Z",
    "dateUpdated": "2024-08-05T01:40:15.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-29473 (GCVE-0-2021-29473)

Vulnerability from cvelistv5 – Published: 2021-04-26 00:00 – Updated: 2024-08-03 22:11

Title

Out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata

Summary

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4. Please see our security policy for information about Exiv2 security.

Severity

2.5 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

CWE

CWE-125 - {"CWE-125":"Out-of-bounds Read"}

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7637 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/Exiv2/exiv2/security/advisorie…
https://github.com/github/advisory-review/pull/1587
https://github.com/Exiv2/exiv2/security/policy
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://www.debian.org/security/2021/dsa-4958	vendor-advisory
https://lists.debian.org/debian-lts-announce/2021…	mailing-list
https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Exiv2	exiv2	Affected: < 0.27.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T22:11:05.516Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-7569-phvm-vwc2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/github/advisory-review/pull/1587"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/Exiv2/exiv2/security/policy"
          },
          {
            "name": "FEDORA-2021-10d7331a31",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/"
          },
          {
            "name": "FEDORA-2021-2d860da728",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWZLDECIXXW3CCZ3RS4A3NG5X5VE4WZM/"
          },
          {
            "name": "FEDORA-2021-96a5dabcfa",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBKWLTXM7IKZ4PVGKLUQVAVFAYGGF7QR/"
          },
          {
            "name": "FEDORA-2021-be94728b95",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/"
          },
          {
            "name": "DSA-4958",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4958"
          },
          {
            "name": "[debian-lts-announce] 20210830 [SECURITY] [DLA 2750-1] exiv2 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html"
          },
          {
            "name": "GLSA-202312-06",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202312-06"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "exiv2",
          "vendor": "Exiv2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.27.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4. Please see our security policy for information about Exiv2 security."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "{\"CWE-125\":\"Out-of-bounds Read\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-22T10:06:24.659Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/Exiv2/exiv2/security/advisories/GHSA-7569-phvm-vwc2"
        },
        {
          "url": "https://github.com/github/advisory-review/pull/1587"
        },
        {
          "url": "https://github.com/Exiv2/exiv2/security/policy"
        },
        {
          "name": "FEDORA-2021-10d7331a31",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/"
        },
        {
          "name": "FEDORA-2021-2d860da728",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWZLDECIXXW3CCZ3RS4A3NG5X5VE4WZM/"
        },
        {
          "name": "FEDORA-2021-96a5dabcfa",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBKWLTXM7IKZ4PVGKLUQVAVFAYGGF7QR/"
        },
        {
          "name": "FEDORA-2021-be94728b95",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/"
        },
        {
          "name": "DSA-4958",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4958"
        },
        {
          "name": "[debian-lts-announce] 20210830 [SECURITY] [DLA 2750-1] exiv2 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html"
        },
        {
          "name": "GLSA-202312-06",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202312-06"
        }
      ],
      "source": {
        "advisory": "GHSA-7569-phvm-vwc2",
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-29473",
    "datePublished": "2021-04-26T00:00:00.000Z",
    "dateReserved": "2021-03-30T00:00:00.000Z",
    "dateUpdated": "2024-08-03T22:11:05.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2022:4208-1

CVE-2017-11591 (GCVE-0-2017-11591)

CVE-2018-11531 (GCVE-0-2018-11531)

CVE-2018-17581 (GCVE-0-2018-17581)

CVE-2018-20097 (GCVE-0-2018-20097)

CVE-2018-20098 (GCVE-0-2018-20098)

CVE-2018-20099 (GCVE-0-2018-20099)

CVE-2019-13109 (GCVE-0-2019-13109)

CVE-2019-13110 (GCVE-0-2019-13110)

CVE-2019-17402 (GCVE-0-2019-17402)

CVE-2021-29473 (GCVE-0-2021-29473)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour