Bug 1068871 - (CVE-2017-1000128) VUL-1: CVE-2017-1000128: exiv2: Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser
(CVE-2017-1000128)
VUL-1: CVE-2017-1000128: exiv2: Exiv2 0.26 contains a stack out of bounds rea...
Status: IN_PROGRESS
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/195309/
CVSSv3:SUSE:CVE-2017-1000128:3.3:(AV...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-11-20 07:58 UTC by Victor Pereira
Modified: 2022-11-07 20:21 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2017-11-20 07:58:46 UTC
CVE-2017-1000128

Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000128
Comment 2 Dirk Mueller 2018-10-16 22:53:06 UTC
looks like SLE12+ is affected.
Comment 3 Dirk Mueller 2018-10-30 10:02:42 UTC
https://github.com/Exiv2/exiv2/pull/193/commits/f0c2d2c3f79c152512612ffa85fcb2451de9baf1

is the fix which was already in the May 30rd update to the 0.26 branch:

-------------------------------------------------------------------
Wed May 30 11:36:20 UTC 2018 - dmueller@suse.com

- update to latest 0.26 branch:
  * obsoletes 0001-Use-more-GNUInstallDirs.patch
  d4e4288d839d0d9546a05986771f8738c382060c.patch
  gcc-version-check.patch
  7f5b0778fa301b68c1c88e3820ec3afbd09dd0a5.patch
  fix-crash.patch
  * adds exiv2-update-to-0.26-branch.patch
  * Fixes CVE-2017-14864 (bsc#1060995),
  * Fixes CVE-2017-1000128 (bsc#1068871)
  CVE-2017-14862 (bsc#1060996), CVE-2017-14859 (bsc#1061000)
  CVE-2017-14860 (bsc#1048883), CVE-2017-11337 (bsc#1048883),
  CVE-2017-11338 (bsc#1048883), CVE-2017-11339 (bsc#1048883),
  CVE-2017-11340 (bsc#1048883), CVE-2017-11553,
  CVE-2017-12955 (bsc#1054593), CVE-2017-12956,
  CVE-2017-12957, CVE-2017-11683, CVE-2017-11592,
  CVE-2017-11591 (bsc#1050257)
Comment 4 Swamp Workflow Management 2018-10-30 10:40:05 UTC
This is an autogenerated message for OBS integration:
This bug (1068871) was mentioned in
https://build.opensuse.org/request/show/645494 Factory / exiv2
Comment 6 Dirk Mueller 2020-03-18 15:11:05 UTC
This change is already in SLE15 maintenance update (just forgot to update the changes file, fixed now). 

a SLE12 backport is not planned
Comment 7 Marcus Meissner 2021-01-18 07:58:53 UTC
sle12 backport not planned becauqse its not possible or too much work or not needed?
Comment 10 Swamp Workflow Management 2022-11-07 20:21:54 UTC
SUSE-SU-2022:3889-1: An update that solves 15 vulnerabilities, contains one feature and has one errata is now available.

Category: security (important)
Bug References: 1068871,1142675,1142679,1185002,1185218,1185447,1185913,1186053,1186192,1188645,1188733,1189332,1189333,1189334,1189335,1189338
CVE References: CVE-2017-1000128,CVE-2019-13108,CVE-2019-13111,CVE-2020-19716,CVE-2021-29457,CVE-2021-29463,CVE-2021-29470,CVE-2021-29623,CVE-2021-31291,CVE-2021-32617,CVE-2021-34334,CVE-2021-37620,CVE-2021-37621,CVE-2021-37622,CVE-2021-37623
JIRA References: PED-1393
Sources used:
openSUSE Leap 15.4 (src):    exiv2-0.27.5-150400.15.4.1, exiv2-0_26-0.26-150400.9.16.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (src):    exiv2-0.27.5-150400.15.4.1, exiv2-0_26-0.26-150400.9.16.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.