Security update for CVE-2017-17723, CVE-2017-17725, CVE-2018-5772

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Exiv2 0.26 has a heap-based buffer over-read in     WebPImage::decodeChunks in     webpimage.cpp.(CVE-2018-14046)

  - There is a heap-based buffer over-read in the     Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2     0.27-RC3. A crafted input will lead to a remote denial     of service attack.(CVE-2018-20096)

  - There is a heap-based buffer over-read in     Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in     Exiv2 0.27-RC3. A crafted input will lead to a remote     denial of service attack.(CVE-2018-20098)

  - There is an infinite loop in     Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in     Exiv2 0.27-RC3. A crafted input will lead to a remote     denial of service attack.(CVE-2018-20099)

  - A PngChunk::parseChunkContent uncontrolled memory     allocation in Exiv2 through 0.27.1 allows an attacker     to cause a denial of service (crash due to an     std::bad_alloc exception) via a crafted PNG image     file.(CVE-2019-13112)

  - CiffDirectory::readDirectory() at crwimage_int.cpp in     Exiv2 0.26 has excessive stack consumption due to a     recursive function, leading to Denial of     service.(CVE-2018-17581)

  - In Exiv2 0.26 and previous versions,     PngChunk::readRawProfile in pngchunk_int.cpp may cause     a denial of service (application crash due to a     heap-based buffer over-read) via a crafted PNG     file.(CVE-2018-19535)

  - In types.cpp in Exiv2 0.26, a large size value may lead     to a SIGABRT during an attempt at memory allocation for     an Exiv2::Internal::PngChunk::zlibUncompress     call.(CVE-2018-10958)

  - An issue was discovered in Exiv2 0.26. readMetadata in     jp2image.cpp allows remote attackers to cause a denial     of service (SIGABRT) by triggering an incorrect     Safe::add call.(CVE-2018-10998)

  - An issue was discovered in Exiv2 0.26. The     Exiv2::Internal::PngChunk::parseTXTChunk function has a     heap-based buffer over-read.(CVE-2018-10999)

  - In Exiv2 0.26, Exiv2::PsdImage::readMetadata in     psdimage.cpp in the PSD image reader may suffer from a     denial of service (infinite loop) caused by an integer     overflow via a crafted PSD image file.(CVE-2018-19108)

  - In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp     (called from psdimage.cpp in the PSD image reader) may     suffer from a denial of service (heap-based buffer     over-read) caused by an integer overflow via a crafted     PSD image file.(CVE-2018-19107)

  - An issue was discovered in Exiv2 v0.26. The function     Exiv2::DataValue::copy in value.cpp has a NULL pointer     dereference.(CVE-2018-17282)

  - exiv2 0.26 contains a Stack out of bounds read in webp     parser(CVE-2017-1000126)

  - In Exiv2 0.26, there is a heap-based buffer over-read     in the Exiv2::Image::byteSwap4 function in image.cpp.
    Remote attackers can exploit this vulnerability to     disclose memory data or cause a denial of service via a     crafted TIFF file.(CVE-2017-17723)

  - Exiv2 0.26 has a heap-based buffer overflow in getData     in preview.cpp.(CVE-2018-11531)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-17723、CVE-2017-17725、CVE-2018-5772のセキュリティ更新

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

遠端主機受到 GLSA-201811-14 中所述的弱點影響 (Exiv2：多個弱點) 在 Exiv2 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。影響：遠端攻擊者可能透過特製的檔案造成拒絕服務情況或取得敏感資訊。因應措施：目前尚無已知的因應措施。

远程主机受到 GLSA-201811-14 中所述漏洞的影响（Exiv2：多个漏洞）在 Exiv2 中发现多个漏洞。请检查下面引用的 CVE 标识符以了解详细信息。影响：远程攻击者可造成拒绝服务情况或通过特别构建的文件获取敏感信息。解决方法：目前无任何已知的解决方法。

The remote host is affected by the vulnerability described in GLSA-201811-14 (Exiv2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Exiv2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service condition or obtain       sensitive information via a specially crafted file.
  Workaround :

    There is no known workaround at this time.

リモートホストは、GLSA-201811-14（Exiv2：複数の脆弱性）で説明されている脆弱性による影響を受けます。複数の脆弱性がExiv2で発見されています。詳細については、以下に記載されているCVE識別番号を参照してください。影響：リモートの攻撃者が、特別に細工されたファイルを介してサービス拒否状態を引き起こしたり、機密情報を取得する可能性があります。回避策：現時点では、既知の回避策はありません。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
120433	Fedora 28 : exiv2 (2018-54c29139b3)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/5	high
130853	EulerOS 2.0 SP5 : exiv2 (EulerOS-SA-2019-2144)	Nessus	Huawei Local Security Checks	2019/11/12	2024/4/12	critical
120433	Fedora 28：exiv2（2018-54c29139b3）	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/5	high
119134	GLSA-201811-14：Exiv2：多個弱點	Nessus	Gentoo Local Security Checks	2018/11/26	2024/7/19	critical
119134	GLSA-201811-14：Exiv2：多个漏洞	Nessus	Gentoo Local Security Checks	2018/11/26	2024/7/19	critical
109928	Fedora 27 : exiv2 (2018-fc9c5969b4)	Nessus	Fedora Local Security Checks	2018/5/21	2024/10/4	high
119134	GLSA-201811-14 : Exiv2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/11/26	2024/7/19	critical
109928	Fedora 27：exiv2（2018-fc9c5969b4）	Nessus	Fedora Local Security Checks	2018/5/21	2024/10/4	high
119134	GLSA-201811-14：Exiv2：複数の脆弱性	Nessus	Gentoo Local Security Checks	2018/11/26	2024/7/19	critical

检测

插件搜索

high

critical

high

critical

critical

high

critical

high

critical