Re: exiv2: multiple memory safety issues

[Raphael Hertzog <hertzog () debian org>]

Hello Hanno,

On Fri, 30 Jun 2017, Hanno Böck wrote:
> I have not reported thoses issues upstream. When I previously tried to
> report bugs in exiv2 found via fuzzing the upstream author made it
> clear to me that he has little interest in fixing those issues and
> doesn't consider his software suitable to parse defect files (which
> basically means it's unsuitable for untrusted input). The discussion
> can be read here [1]. (the page is sometimes not available, searching
> for it in the google cache usually works though)
>
> exiv2 is to my knowledge used by the major Linux Desktops GNOME and
> KDE. I'll also inform their security teams. I leave it up to Linux
> distros how to handle this, but it certainly is problematic that a
> crucial parser used by major desktop applications is not interested in
> fixing potential security issues.
>
> [1] http://dev.exiv2.org/issues/1248

FWIW, Robin Mills is moving away from exiv2, it is being handed over to
new developers and they have been rather responsive to the various
security issues that have been reported in the last months.

Search for CVE in https://github.com/Exiv2/exiv2/issues

So please file bugs on github, thank you.

I just add the CVE assigned through the Distributed Weakness Filing
Project.

> Heap overflow (write) in tiff parser

CVE-2017-1000127
        
> Heap out of bounds read in jp2 / JPEG2000 parser

CVE-2017-1000128

> Stack out of bounds read in webp parser

CVE-2017-1000126

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/