Bugzilla – Bug 1204823
VUL-0: CVE-2022-3719: exiv2: heap-based buffer overflow in QuickTime Video Handler
Last modified: 2022-10-31 08:36:05 UTC
CVE-2022-3719 A vulnerability has been found in Exiv2 and classified as critical. This vulnerability affects the function QuickTimeVideo::userDataDecoder of the file quicktimevideo.cpp of the component QuickTime Video Handler. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The name of the patch is a38e124076138e529774d5ec9890d0731058115a. It is recommended to apply a patch to fix this issue. VDB-212350 is the identifier assigned to this vulnerability. Upstream fix: https://github.com/Exiv2/exiv2/commit/a38e124076138e529774d5ec9890d0731058115a References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3719 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51707 https://www.cve.org/CVERecord?id=CVE-2022-3719 https://github.com/Exiv2/exiv2/commit/a38e124076138e529774d5ec9890d0731058115a http://www.cvedetails.com/cve/CVE-2022-3719/ https://vuldb.com/?id.212350
Affected: - SUSE:SLE-15:Update - SUSE:SLE-15-SP4:Update - openSUSE:Factory
this is invalid. Exiv2 0.27 and later have dropped that quicktime video handler due to low code quality. so the issue does not exist there. so SLE-15-SP4 and Factory are not affected. the commits exist in *git main* branch only as they resurrected the feature, but there isn't a released version with that functionality. calling CVE's for that is dubious imho at best. The code does exist in 0.26, however it is disabled from compilation by default, so we're not affected.
(In reply to Dirk Mueller from comment #2) > this is invalid. Exiv2 0.27 and later have dropped that quicktime video > handler due to low code quality. so the issue does not exist there. so > SLE-15-SP4 and Factory are not affected. the commits exist in *git main* > branch only as they resurrected the feature, but there isn't a released > version with that functionality. calling CVE's for that is dubious imho at > best. > > The code does exist in 0.26, however it is disabled from compilation by > default, so we're not affected. Thanks for checking Dirk. Afaics sle15sp4 ships 0.26, which is also not affected. Nothing affected, closing