Ubuntu Security Notices
USN-3700-1

USN-3700-1: Exiv2 vulnerabilities

Publication date

3 July 2018

Overview

Several security issues were fixed in Exiv2.

Releases

18.04 LTS 17.10 16.04 LTS 14.04 LTS

Packages

exiv2 - EXIF/IPTC/XMP metadata manipulation tool

Details

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to cause a denial of service.
(CVE-2018-10958, CVE-2018-10998)

It was discovered that Exiv2 incorrectly handled certain PNG files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-10999)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to execute arbitrary code.
(CVE-2018-11531)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-12264, CVE-2018-12265)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to cause a denial of service.
(CVE-2018-10958, CVE-2018-10998)

It was discovered that Exiv2 incorrectly handled certain PNG files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-10999)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to execute arbitrary code.
(CVE-2018-11531)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-12264, CVE-2018-12265)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
18.04 bionic	exiv2 – 0.25-3.1ubuntu0.18.04.1
18.04 bionic	libexiv2-14 – 0.25-3.1ubuntu0.18.04.1
17.10 artful	exiv2 – 0.25-3.1ubuntu0.17.10.1
17.10 artful	libexiv2-14 – 0.25-3.1ubuntu0.17.10.1
16.04 xenial	exiv2 – 0.25-2.1ubuntu16.04.2
16.04 xenial	libexiv2-14 – 0.25-2.1ubuntu16.04.2
14.04 trusty	exiv2 – 0.23-1ubuntu2.1
14.04 trusty	libexiv2-12 – 0.23-1ubuntu2.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

USN-3700-1: Exiv2 vulnerabilities

Packages

Details

Update instructions

Reduce your security exposure

References