Bugzilla – Bug 1061003
VUL-0: CVE-2017-14865: exiv2: It is a heap-buffer-overflow in Exiv2::us2Data (types.cpp:346)
Last modified: 2018-10-18 14:43:24 UTC
rh#1494778 There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack. References: https://bugzilla.redhat.com/show_bug.cgi?id=1494778 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-14865 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14865.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14865
submitted for Leap 42.2/42.3
This is an autogenerated message for OBS integration: This bug (1061003) was mentioned in https://build.opensuse.org/request/show/534433 42.2 / exiv2 https://build.opensuse.org/request/show/534434 42.3 / exiv2
openSUSE-SU-2017:2818-1: An update that fixes 5 vulnerabilities is now available. Category: security (moderate) Bug References: 1050257,1051188,1060996,1061000,1061003 CVE References: CVE-2017-11591,CVE-2017-11683,CVE-2017-14859,CVE-2017-14862,CVE-2017-14865 Sources used: openSUSE Leap 42.3 (src): exiv2-0.25-10.1 openSUSE Leap 42.2 (src): exiv2-0.25-7.3.1
what needs fixing? the fix for this was https://github.com/Exiv2/exiv2/pull/165/commits/1dcf714f4b47fc264bd5bd13365b55e44ce83d3f and that code path does not exist in sle12 or older.
(In reply to Dirk Mueller from comment #7) yes, initial estimate was incorrect, I adjusted our tracking. Thanks