Bug 1068871 - (CVE-2017-1000128) VUL-1: CVE-2017-1000128: exiv2: Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser
(CVE-2017-1000128)
VUL-1: CVE-2017-1000128: exiv2: Exiv2 0.26 contains a stack out of bounds rea...
Status: IN_PROGRESS
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/195309/
CVSSv3:SUSE:CVE-2017-1000128:3.3:(AV...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-11-20 07:58 UTC by Victor Pereira
Modified: 2021-01-18 07:58 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2017-11-20 07:58:46 UTC
CVE-2017-1000128

Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000128
Comment 2 Dirk Mueller 2018-10-16 22:53:06 UTC
looks like SLE12+ is affected.
Comment 3 Dirk Mueller 2018-10-30 10:02:42 UTC
https://github.com/Exiv2/exiv2/pull/193/commits/f0c2d2c3f79c152512612ffa85fcb2451de9baf1

is the fix which was already in the May 30rd update to the 0.26 branch:

-------------------------------------------------------------------
Wed May 30 11:36:20 UTC 2018 - dmueller@suse.com

- update to latest 0.26 branch:
  * obsoletes 0001-Use-more-GNUInstallDirs.patch
  d4e4288d839d0d9546a05986771f8738c382060c.patch
  gcc-version-check.patch
  7f5b0778fa301b68c1c88e3820ec3afbd09dd0a5.patch
  fix-crash.patch
  * adds exiv2-update-to-0.26-branch.patch
  * Fixes CVE-2017-14864 (bsc#1060995),
  * Fixes CVE-2017-1000128 (bsc#1068871)
  CVE-2017-14862 (bsc#1060996), CVE-2017-14859 (bsc#1061000)
  CVE-2017-14860 (bsc#1048883), CVE-2017-11337 (bsc#1048883),
  CVE-2017-11338 (bsc#1048883), CVE-2017-11339 (bsc#1048883),
  CVE-2017-11340 (bsc#1048883), CVE-2017-11553,
  CVE-2017-12955 (bsc#1054593), CVE-2017-12956,
  CVE-2017-12957, CVE-2017-11683, CVE-2017-11592,
  CVE-2017-11591 (bsc#1050257)
Comment 4 Swamp Workflow Management 2018-10-30 10:40:05 UTC
This is an autogenerated message for OBS integration:
This bug (1068871) was mentioned in
https://build.opensuse.org/request/show/645494 Factory / exiv2
Comment 6 Dirk Mueller 2020-03-18 15:11:05 UTC
This change is already in SLE15 maintenance update (just forgot to update the changes file, fixed now). 

a SLE12 backport is not planned
Comment 7 Marcus Meissner 2021-01-18 07:58:53 UTC
sle12 backport not planned becauqse its not possible or too much work or not needed?