CVE-2018-11531
exiv2: heap-based buffer overflow in getData in preview.cpp
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (faible), Ubuntu (faible).
Description
Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | exiv2 | 0.25-4 |
| debian 12 | exiv2 | 0.25-4 |
| debian 13 | exiv2 | 0.25-4 |
| debian 14 | exiv2 | 0.25-4 |
| debian 8 | exiv2 | 0.24-4.1+deb8u1 |
| debian 9 | exiv2 | 0.25-3.1+deb9u1 |
| echo | exiv2 | 0.25-4 |
| ubuntu 14.04 | exiv2 | 0.23-1ubuntu2.1 |
| ubuntu 16.04 | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 16.04-ESM | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 17.10 | exiv2 | 0.25-3.1ubuntu0.17.10.1 |
| ubuntu 18.04 | exiv2 | 0.25-3.1ubuntu0.18.04.1 |
Afficher les 13 entrées de 13 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | exiv2 | 0.25-4 |
| debian 12 | exiv2 | 0.25-4 |
| debian 13 | exiv2 | 0.25-4 |
| debian 14 | exiv2 | 0.25-4 |
| debian 8 | exiv2 | 0.24-4.1+deb8u1 |
| debian 9 | exiv2 | 0.25-3.1+deb9u1 |
| echo | exiv2 | 0.25-4 |
| ubuntu 14.04 | exiv2 | 0.23-1ubuntu2.1 |
| ubuntu 16.04 | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 16.04-ESM | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 17.10 | exiv2 | 0.25-3.1ubuntu0.17.10.1 |
| ubuntu 18.04 | exiv2 | 0.25-3.1ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | exiv2 | 0.25-3.1ubuntu0.18.04.1 |
Références
- https://access.redhat.com/security/cve/CVE-2018-11531
- https://github.com/Exiv2/exiv2/issues/283
- https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-11531
- https://security.gentoo.org/glsa/201811-14
- https://ubuntu.com/security/notices/USN-3700-1
- https://usn.ubuntu.com/3700-1/
- https://www.cve.org/CVERecord?id=CVE-2018-11531