SB2019100936 - Multiple vulnerabilities in Exiv2

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2019-17402)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary in Exiv2::getULong() function in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp. A remote attacker can pass specially crafted data to the application, trigger memory corruption and crash the service.

2) Infinite loop (CVE-ID: CVE-2019-20421)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the Jp2Image::readMetadata() in jp2image.cpp. A remote attacker can create a specially crafted image file, pass it to the affected application and consume all available system resources or cause denial of service conditions.

Remediation

Install update from vendor's website.

References

• https://github.com/Exiv2/exiv2/issues/1019
• https://lists.debian.org/debian-lts-announce/2019/12/msg00001.html
• https://usn.ubuntu.com/4159-1/
• https://github.com/Exiv2/exiv2/commit/a82098f4f90cd86297131b5663c3dec6a34470e8
• https://github.com/Exiv2/exiv2/issues/1011
• https://usn.ubuntu.com/4270-1/