SB2021111079 - Red Hat Enterprise Linux 8 update for compat-exiv2-026

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Integer overflow (CVE-ID: CVE-2021-31292)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow CrwMap::encode0x1810 of Exiv2. A remote attacker can pass specially crafted data to the application, trigger integer overflow and crash the application.

2) Out-of-bounds read (CVE-ID: CVE-2021-37618)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in Exiv2::Jp2Image::printStructure(). A remote attacker can pass a specially crafted file to the application, trigger an out-of-bounds read error and perform a denial of service attack.

3) Out-of-bounds read (CVE-ID: CVE-2021-37619)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in Exiv2::Jp2Image::encodeJp2Header(). A remote attacker can pass a specially crafted file to the application, trigger an out-of-bounds read error and perform a denial of service attack.

Remediation

Install update from vendor's website.

References

• https://access.redhat.com/errata/RHSA-2021:4319