CVE-2018-11531
exiv2: heap-based buffer overflow in getData in preview.cpp
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (düşük), Ubuntu (düşük).
Açıklama
Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | exiv2 | 0.25-4 |
| debian 12 | exiv2 | 0.25-4 |
| debian 13 | exiv2 | 0.25-4 |
| debian 14 | exiv2 | 0.25-4 |
| debian 8 | exiv2 | 0.24-4.1+deb8u1 |
| debian 9 | exiv2 | 0.25-3.1+deb9u1 |
| echo | exiv2 | 0.25-4 |
| ubuntu 14.04 | exiv2 | 0.23-1ubuntu2.1 |
| ubuntu 16.04 | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 16.04-ESM | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 17.10 | exiv2 | 0.25-3.1ubuntu0.17.10.1 |
| ubuntu 18.04 | exiv2 | 0.25-3.1ubuntu0.18.04.1 |
13 kaynaktaki 13 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | exiv2 | 0.25-4 |
| debian 12 | exiv2 | 0.25-4 |
| debian 13 | exiv2 | 0.25-4 |
| debian 14 | exiv2 | 0.25-4 |
| debian 8 | exiv2 | 0.24-4.1+deb8u1 |
| debian 9 | exiv2 | 0.25-3.1+deb9u1 |
| echo | exiv2 | 0.25-4 |
| ubuntu 14.04 | exiv2 | 0.23-1ubuntu2.1 |
| ubuntu 16.04 | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 16.04-ESM | exiv2 | 0.25-2.1ubuntu16.04.2 |
| ubuntu 17.10 | exiv2 | 0.25-3.1ubuntu0.17.10.1 |
| ubuntu 18.04 | exiv2 | 0.25-3.1ubuntu0.18.04.1 |
| ubuntu 18.04-ESM | exiv2 | 0.25-3.1ubuntu0.18.04.1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2018-11531
- https://github.com/Exiv2/exiv2/issues/283
- https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-11531
- https://security.gentoo.org/glsa/201811-14
- https://ubuntu.com/security/notices/USN-3700-1
- https://usn.ubuntu.com/3700-1/
- https://www.cve.org/CVERecord?id=CVE-2018-11531