GLSA 201811-14: Exiv2: Multiple vulnerabilities

http://security.gentoo.org/

Severity:	normal
Title:	Exiv2: Multiple vulnerabilities
Date:	11/24/2018
Bugs:	#647810, #647812, #647816, #652822, #655842, #655958, #658236
ID:	201811-14

Synopsis

Multiple vulnerabilities have been found in Exiv2, the worst of which could result in a Denial of Service condition.

Background

Exiv2 is a C++ library and a command line utility to manage image metadata.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
media-gfx/exiv2	< 0.26_p20180811-r3	>= 0.26_p20180811-r3	All supported architectures

Description

Multiple vulnerabilities have been discovered in Exiv2. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could cause a Denial of Service condition or obtain sensitive information via a specially crafted file.

Workaround

There is no known workaround at this time.

Resolution

All Exiv2 users should upgrade to the latest version:

      # emerge --sync
      # emerge --ask --oneshot --verbose
      ">=media-gfx/exiv2-0.26_p20180811-r3"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201811-14.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.