Bug 1068871 (CVE-2017-1000128)

Summary: VUL-1: CVE-2017-1000128: exiv2: Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser
Product: [Novell Products] SUSE Security Incidents Reporter: Victor Pereira <vpereira>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: abergmann, carlos.lopez, dmueller, karol, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/195309/
Whiteboard: CVSSv3:SUSE:CVE-2017-1000128:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) maint:planned:update
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Victor Pereira 2017-11-20 07:58:46 UTC

Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser

Comment 2 Dirk Mueller 2018-10-16 22:53:06 UTC
looks like SLE12+ is affected.
Comment 3 Dirk Mueller 2018-10-30 10:02:42 UTC

is the fix which was already in the May 30rd update to the 0.26 branch:

Wed May 30 11:36:20 UTC 2018 - dmueller@suse.com

- update to latest 0.26 branch:
  * obsoletes 0001-Use-more-GNUInstallDirs.patch
  * adds exiv2-update-to-0.26-branch.patch
  * Fixes CVE-2017-14864 (bsc#1060995),
  * Fixes CVE-2017-1000128 (bsc#1068871)
  CVE-2017-14862 (bsc#1060996), CVE-2017-14859 (bsc#1061000)
  CVE-2017-14860 (bsc#1048883), CVE-2017-11337 (bsc#1048883),
  CVE-2017-11338 (bsc#1048883), CVE-2017-11339 (bsc#1048883),
  CVE-2017-11340 (bsc#1048883), CVE-2017-11553,
  CVE-2017-12955 (bsc#1054593), CVE-2017-12956,
  CVE-2017-12957, CVE-2017-11683, CVE-2017-11592,
  CVE-2017-11591 (bsc#1050257)
Comment 4 Swamp Workflow Management 2018-10-30 10:40:05 UTC
This is an autogenerated message for OBS integration:
This bug (1068871) was mentioned in
https://build.opensuse.org/request/show/645494 Factory / exiv2
Comment 6 Dirk Mueller 2020-03-18 15:11:05 UTC
This change is already in SLE15 maintenance update (just forgot to update the changes file, fixed now). 

a SLE12 backport is not planned
Comment 7 Marcus Meissner 2021-01-18 07:58:53 UTC
sle12 backport not planned becauqse its not possible or too much work or not needed?
Comment 10 Swamp Workflow Management 2022-11-07 20:21:54 UTC
SUSE-SU-2022:3889-1: An update that solves 15 vulnerabilities, contains one feature and has one errata is now available.

Category: security (important)
Bug References: 1068871,1142675,1142679,1185002,1185218,1185447,1185913,1186053,1186192,1188645,1188733,1189332,1189333,1189334,1189335,1189338
CVE References: CVE-2017-1000128,CVE-2019-13108,CVE-2019-13111,CVE-2020-19716,CVE-2021-29457,CVE-2021-29463,CVE-2021-29470,CVE-2021-29623,CVE-2021-31291,CVE-2021-32617,CVE-2021-34334,CVE-2021-37620,CVE-2021-37621,CVE-2021-37622,CVE-2021-37623
JIRA References: PED-1393
Sources used:
openSUSE Leap 15.4 (src):    exiv2-0.27.5-150400.15.4.1, exiv2-0_26-0.26-150400.9.16.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (src):    exiv2-0.27.5-150400.15.4.1, exiv2-0_26-0.26-150400.9.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Carlos López 2023-03-24 11:47:37 UTC
Done, closing.