[USN-3700-1] Exiv2 vulnerabilities


–===============6154722254773516956==
Content-Type: multipart/signed; micalg=”pgp-sha256″;
protocol=”application/pgp-signature”; boundary=”=-2cZr9UH6D1PDF6MY2qKW”

–=-2cZr9UH6D1PDF6MY2qKW
Content-Type: text/plain; charset=”UTF-8″
Content-Transfer-Encoding: quoted-printable

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ubuntu Security Notice USN-3700-1
July 03, 2018

exiv2 vulnerabilities
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS
– Ubuntu 17.10
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Exiv2.

Software Description:
– exiv2: EXIF/IPTC/XMP metadata manipulation tool

Details:

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to cause a denial of service.
(CVE-2018-10958, CVE-2018-10998)

It was discovered that Exiv2 incorrectly handled certain PNG files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-10999)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to execute arbitrary code.
(CVE-2018-11531)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-12264, CVE-2018-12265)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
=C2=A0 exiv2=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A00.25-3.1ubuntu0.18.04.1
=C2=A0 libexiv2-14=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A00.25-3=
.1ubuntu0.18.04.1

Ubuntu 17.10:
=C2=A0 exiv2=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A00.25-3.1ubuntu0.17.10.1
=C2=A0 libexiv2-14=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A00.25-3=
.1ubuntu0.17.10.1

Ubuntu 16.04 LTS:
=C2=A0 exiv2=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A00.25-2.1ubuntu16.04.2
=C2=A0 libexiv2-14=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A00.25-2=
.1ubuntu16.04.2

Ubuntu 14.04 LTS:
=C2=A0 exiv2=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A00.23-1ubuntu2.1
=C2=A0 libexiv2-12=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A00.23-1=
ubuntu2.1

In general, a standard system update will make all the necessary
changes.

References:
=C2=A0 https://usn.ubuntu.com/usn/usn-3700-1
=C2=A0 CVE-2018-10958, CVE-2018-10998, CVE-2018-10999, CVE-2018-11531,
=C2=A0 CVE-2018-12264, CVE-2018-12265

Package Information:
=C2=A0 https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.18.04.1
=C2=A0 https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.17.10.1
=C2=A0 https://launchpad.net/ubuntu/+source/exiv2/0.25-2.1ubuntu16.04.2
=C2=A0 https://launchpad.net/ubuntu/+source/exiv2/0.23-1ubuntu2.1
–=-2cZr9UH6D1PDF6MY2qKW
Content-Type: application/pgp-signature; name=”signature.asc”
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2

iQIcBAABCAAGBQJbO7TmAAoJEEW851uECx9pME0QALwYaa3RAEZApCv55BWXf1KL
DpVmXtDaHGkjOvHckMh5uZEpgnMjmDH36LXMdjNTPWmynSRt5Zw+3NBTM/eJzD5l
gd/uaq/iQytwfrg8h47AfpE3VOqCKigrkqqZ7Tc3X4ISZJHLpMgdFI2cfXPXIoPm
6XZJ+wcEKfA6aiC7XM6duaNJnks+5LP+Lld5UAn3c2pfjbdp1QTzGFm86cIoYVLy
ch+H+TEuTM9RqbXcfhO03n7+yfWhNQnxGzAgTid9+ttX07CnRBns6wGc6JRAwJmM
GRJb5oDJALFDft/JHe5q+Z/23ytjt1W0DPh6sLQEPnNJi6cQAu+WMMNEZB4fjLGL
IvG4iKd4ljEYUUb3cHIMCgl9uPZQVanruI7SgDBi7UXMRXX3g6WUEDhD/imHIxkr
fwknTKpSV5MpU8Fd7dYbRt0H4QYViA4dHnLBluvmPNoUqvzZpj5QdyvBINIv0zRH
5rdU6mbA5P/rfbTacpwbZSE4b4AkU2OFVQYovKsIcSYyX4vrIV2Q1PG2ZP2rIVGR
bvMAHO1O3GIUGN1Gcotu7lj+WEEcK1H9hYh1eiBm1jp+gVxfcq80HVDN91X8PJuj
WowzNr8LS2tZ6hqE9MFjzvCuyBLnxR+XwUWr+eb4c39MICHPqVRisrHETpVw3eq7
i2X9Cp42rCNH8OgCJbRU
=TjNU
—–END PGP SIGNATURE—–

–=-2cZr9UH6D1PDF6MY2qKW–

–===============6154722254773516956==
Content-Type: text/plain; charset=”utf-8″
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

–===============6154722254773516956==–