Bug 1068871 (CVE-2017-1000128)

Summary:	VUL-1: CVE-2017-1000128: exiv2: Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Victor Pereira <vpereira>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	abergmann, carlos.lopez, dmueller, karol, smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/195309/
Whiteboard:	CVSSv3:SUSE:CVE-2017-1000128:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) maint:planned:update
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Victor Pereira 2017-11-20 07:58:46 UTC

CVE-2017-1000128

Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000128

Comment 2 Dirk Mueller 2018-10-16 22:53:06 UTC

looks like SLE12+ is affected.

Comment 3 Dirk Mueller 2018-10-30 10:02:42 UTC

https://github.com/Exiv2/exiv2/pull/193/commits/f0c2d2c3f79c152512612ffa85fcb2451de9baf1

is the fix which was already in the May 30rd update to the 0.26 branch:

-------------------------------------------------------------------
Wed May 30 11:36:20 UTC 2018 - dmueller@suse.com

- update to latest 0.26 branch:
  * obsoletes 0001-Use-more-GNUInstallDirs.patch
  d4e4288d839d0d9546a05986771f8738c382060c.patch
  gcc-version-check.patch
  7f5b0778fa301b68c1c88e3820ec3afbd09dd0a5.patch
  fix-crash.patch
  * adds exiv2-update-to-0.26-branch.patch
  * Fixes CVE-2017-14864 (bsc#1060995),
  * Fixes CVE-2017-1000128 (bsc#1068871)
  CVE-2017-14862 (bsc#1060996), CVE-2017-14859 (bsc#1061000)
  CVE-2017-14860 (bsc#1048883), CVE-2017-11337 (bsc#1048883),
  CVE-2017-11338 (bsc#1048883), CVE-2017-11339 (bsc#1048883),
  CVE-2017-11340 (bsc#1048883), CVE-2017-11553,
  CVE-2017-12955 (bsc#1054593), CVE-2017-12956,
  CVE-2017-12957, CVE-2017-11683, CVE-2017-11592,
  CVE-2017-11591 (bsc#1050257)

Comment 4 Swamp Workflow Management 2018-10-30 10:40:05 UTC

This is an autogenerated message for OBS integration:
This bug (1068871) was mentioned in
https://build.opensuse.org/request/show/645494 Factory / exiv2

Comment 6 Dirk Mueller 2020-03-18 15:11:05 UTC

This change is already in SLE15 maintenance update (just forgot to update the changes file, fixed now). 

a SLE12 backport is not planned

Comment 7 Marcus Meissner 2021-01-18 07:58:53 UTC

sle12 backport not planned becauqse its not possible or too much work or not needed?

Comment 10 Swamp Workflow Management 2022-11-07 20:21:54 UTC

SUSE-SU-2022:3889-1: An update that solves 15 vulnerabilities, contains one feature and has one errata is now available.

Category: security (important)
Bug References: 1068871,1142675,1142679,1185002,1185218,1185447,1185913,1186053,1186192,1188645,1188733,1189332,1189333,1189334,1189335,1189338
CVE References: CVE-2017-1000128,CVE-2019-13108,CVE-2019-13111,CVE-2020-19716,CVE-2021-29457,CVE-2021-29463,CVE-2021-29470,CVE-2021-29623,CVE-2021-31291,CVE-2021-32617,CVE-2021-34334,CVE-2021-37620,CVE-2021-37621,CVE-2021-37622,CVE-2021-37623
JIRA References: PED-1393
Sources used:
openSUSE Leap 15.4 (src):    exiv2-0.27.5-150400.15.4.1, exiv2-0_26-0.26-150400.9.16.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (src):    exiv2-0.27.5-150400.15.4.1, exiv2-0_26-0.26-150400.9.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Carlos López 2023-03-24 11:47:37 UTC

Done, closing.