CVE-2018-11531
exiv2: heap-based buffer overflow in getData in preview.cpp
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (niedrig), Ubuntu (niedrig).
Beschreibung
Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | exiv2 | 0.25-4 |
| debian 12 | exiv2 | 0.25-4 |
| debian 13 | exiv2 | 0.25-4 |
| debian 14 | exiv2 | 0.25-4 |
| debian 8 | exiv2 | 0.24-4.1+deb8u1 |
| debian 9 | exiv2 | 0.25-3.1+deb9u1 |
| echo | exiv2 | 0.25-4 |
| ubuntu 14.04 | exiv2 | 0.23-1ubuntu2.1 |
| ubuntu 16.04 | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 16.04-ESM | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 17.10 | exiv2 | 0.25-3.1ubuntu0.17.10.1 |
| ubuntu 18.04 | exiv2 | 0.25-3.1ubuntu0.18.04.1 |
Alle 13 Einträge aus 13 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | exiv2 | 0.25-4 |
| debian 12 | exiv2 | 0.25-4 |
| debian 13 | exiv2 | 0.25-4 |
| debian 14 | exiv2 | 0.25-4 |
| debian 8 | exiv2 | 0.24-4.1+deb8u1 |
| debian 9 | exiv2 | 0.25-3.1+deb9u1 |
| echo | exiv2 | 0.25-4 |
| ubuntu 14.04 | exiv2 | 0.23-1ubuntu2.1 |
| ubuntu 16.04 | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 16.04-ESM | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 17.10 | exiv2 | 0.25-3.1ubuntu0.17.10.1 |
| ubuntu 18.04 | exiv2 | 0.25-3.1ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | exiv2 | 0.25-3.1ubuntu0.18.04.1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2018-11531
- https://github.com/Exiv2/exiv2/issues/283
- https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-11531
- https://security.gentoo.org/glsa/201811-14
- https://ubuntu.com/security/notices/USN-3700-1
- https://usn.ubuntu.com/3700-1/
- https://www.cve.org/CVERecord?id=CVE-2018-11531