ID de Prueba:	1.3.6.1.4.1.25623.1.0.883101
Categoría:	CentOS Local Security Checks
Título:	CentOS Update for exiv2 CESA-2019:2101 centos7
Resumen:	The remote host is missing an update for the 'exiv2'; package(s) announced via the CESA-2019:2101 advisory.
Descripción:	Summary: The remote host is missing an update for the 'exiv2' package(s) announced via the CESA-2019:2101 advisory. Vulnerability Insight: The exiv2 packages provide a command line utility which can display and manipulate image metadata such as EXIF, LPTC, and JPEG comments. The following packages have been upgraded to a later upstream version: exiv2 (0.27.0). (BZ#1652637) Security Fix(es): * exiv2: heap-buffer-overflow in Exiv2::IptcData::printStructure in src/iptc.cpp (CVE-2017-17724) * exiv2: out-of-bounds read in Exiv2::Internal::stringFormat image.cpp (CVE-2018-8976) * exiv2: invalid memory access in Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp (CVE-2018-8977) * exiv2: out of bounds read in IptcData::printStructure in iptc.c (CVE-2018-9305) * exiv2: OOB read in pngimage.cpp:tEXtToDataBuf() allows for crash via crafted file (CVE-2018-10772) * exiv2: SIGABRT caused by memory allocation in types.cpp:Exiv2::Internal::PngChunk::zlibUncompress() (CVE-2018-10958) * exiv2: SIGABRT by triggering an incorrect Safe::add call (CVE-2018-10998) * exiv2: information leak via a crafted file (CVE-2018-11037) * exiv2: integer overflow in getData function in preview.cpp (CVE-2018-12264) * exiv2: integer overflow in the LoaderExifJpeg class in preview.cpp (CVE-2018-12265) * exiv2: heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp (CVE-2018-14046) * exiv2: NULL pointer dereference in Exiv2::DataValue::copy in value.cpp leading to application crash (CVE-2018-17282) * exiv2: Stack overflow in CiffDirectory::readDirectory() at crwimage_int.cpp leading to denial of service (CVE-2018-17581) * exiv2: infinite loop in Exiv2::Image::printIFDStructure function in image.cpp (CVE-2018-18915) * exiv2: heap-based buffer over-read in Exiv2::IptcParser::decode in iptc.cpp (CVE-2018-19107) * exiv2: infinite loop in Exiv2::PsdImage::readMetadata in psdimage.cpp (CVE-2018-19108) * exiv2: heap-based buffer over-read in PngChunk::readRawProfile in pngchunk_int.cpp (CVE-2018-19535) * exiv2: NULL pointer dereference in Exiv2::isoSpeed in easyaccess.cpp (CVE-2018-19607) * exiv2: Heap-based buffer over-read in Exiv2::tEXtToDataBuf function resulting in a denial of service (CVE-2018-20096) * exiv2: Segmentation fault in Exiv2::Internal::TiffParserWorker::findPrimaryGroups function (CVE-2018-20097) * exiv2: Heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header resulting in a denial of service (CVE-2018-20098) * exiv2: Infinite loop in Exiv2::Jp2Image::encodeJp2Header resulting in a denial of service (CVE-2018-20099) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section. Affected Software/OS: 'exiv2' package(s) on CentOS 7. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2017-17724 https://security.gentoo.org/glsa/201811-14 https://bugzilla.redhat.com/show_bug.cgi?id=1524107 https://github.com/Exiv2/exiv2/issues/263 https://github.com/xiaoqx/pocs/blob/master/exiv2/readme.md RedHat Security Advisories: RHSA-2019:2101 https://access.redhat.com/errata/RHSA-2019:2101 Common Vulnerability Exposure (CVE) ID: CVE-2018-8976 https://github.com/Exiv2/exiv2/issues/246 https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html Common Vulnerability Exposure (CVE) ID: CVE-2018-8977 https://github.com/Exiv2/exiv2/issues/247 Common Vulnerability Exposure (CVE) ID: CVE-2018-9305 SuSE Security Announcement: openSUSE-SU-2020:0482 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html Common Vulnerability Exposure (CVE) ID: CVE-2018-10772 https://bugzilla.redhat.com/show_bug.cgi?id=1566260 Common Vulnerability Exposure (CVE) ID: CVE-2018-10958 Debian Security Information: DSA-4238 (Google Search) https://www.debian.org/security/2018/dsa-4238 https://github.com/Exiv2/exiv2/issues/302 https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html https://lists.debian.org/debian-lts-announce/2018/10/msg00012.html https://usn.ubuntu.com/3700-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-10998 https://github.com/Exiv2/exiv2/issues/303 Common Vulnerability Exposure (CVE) ID: CVE-2018-11037 https://github.com/Exiv2/exiv2/issues/307 Common Vulnerability Exposure (CVE) ID: CVE-2018-12264 Common Vulnerability Exposure (CVE) ID: CVE-2018-12265 Common Vulnerability Exposure (CVE) ID: CVE-2018-14046 https://github.com/Exiv2/exiv2/issues/378 Common Vulnerability Exposure (CVE) ID: CVE-2018-17282 https://github.com/Exiv2/exiv2/issues/457 Common Vulnerability Exposure (CVE) ID: CVE-2018-17581 https://github.com/Exiv2/exiv2/issues/460 https://github.com/SegfaultMasters/covering360/blob/master/Exiv2 https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html https://usn.ubuntu.com/3852-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-18915 https://github.com/Exiv2/exiv2/issues/511 Common Vulnerability Exposure (CVE) ID: CVE-2018-19107 https://github.com/Exiv2/exiv2/issues/427 https://github.com/Exiv2/exiv2/pull/518 https://usn.ubuntu.com/4056-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-19108 https://github.com/Exiv2/exiv2/issues/426 Common Vulnerability Exposure (CVE) ID: CVE-2018-19535 https://github.com/Exiv2/exiv2/issues/428 https://github.com/Exiv2/exiv2/pull/430 Common Vulnerability Exposure (CVE) ID: CVE-2018-19607 https://github.com/Exiv2/exiv2/issues/561 Common Vulnerability Exposure (CVE) ID: CVE-2018-20096 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXCEKTYF7HLM6VH2WCWO2HXTJH37MBLA/ https://github.com/Exiv2/exiv2/issues/590 https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206 Common Vulnerability Exposure (CVE) ID: CVE-2018-20097 Common Vulnerability Exposure (CVE) ID: CVE-2018-20098 Common Vulnerability Exposure (CVE) ID: CVE-2018-20099
Copyright	Copyright (C) 2019 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.