Bug 1205391 - (CVE-2022-3953) VUL-0: CVE-2022-3953: exiv2: infinite loop in QuickTimeVideo::multipleEntriesDecoder()
(CVE-2022-3953)
VUL-0: CVE-2022-3953: exiv2: infinite loop in QuickTimeVideo::multipleEntries...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/347844/
CVSSv3.1:SUSE:CVE-2022-3953:5.5:(AV:L...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-11-14 09:50 UTC by Carlos López
Modified: 2022-11-14 23:35 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2022-11-14 09:50:07 UTC
CVE-2022-3953

A vulnerability was found in Exiv2. It has been classified as problematic. This
affects the function QuickTimeVideo::multipleEntriesDecoder of the file
quicktimevideo.cpp of the component QuickTime Video Handler. The manipulation
leads to infinite loop. It is possible to initiate the attack remotely. The name
of the patch is 771ead87321ae6e39e5c9f6f0855c58cde6648f1. It is recommended to
apply a patch to fix this issue. The associated identifier of this vulnerability
is VDB-213459.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3953
https://github.com/Exiv2/exiv2/commit/771ead87321ae6e39e5c9f6f0855c58cde6648f1
https://www.cve.org/CVERecord?id=CVE-2022-3953
https://github.com/Exiv2/exiv2/pull/2394
https://vuldb.com/?id.213459
Comment 1 Carlos López 2022-11-14 09:51:27 UTC
Affected:
- SUSE:SLE-15:Update/exiv2
- SUSE:SLE-15-SP4:Update/exiv2
- openSUSE:Factory/exiv2
Comment 2 Dirk Mueller 2022-11-14 12:07:14 UTC
How did you determine that we're affected? quicktime video is not compiled on SLE15-SP4 and older: 

iosc rbl SUSE:SLE-15-SP4:Update exiv2.26338 standard x86_64 | grep "Building video"
[   78s] -- Building video support:             NO
Comment 3 Carlos López 2022-11-14 12:12:41 UTC
(In reply to Dirk Mueller from comment #2)
> How did you determine that we're affected? quicktime video is not compiled
> on SLE15-SP4 and older: 
> 
> iosc rbl SUSE:SLE-15-SP4:Update exiv2.26338 standard x86_64 | grep "Building
> video"
> [   78s] -- Building video support:             NO

I only examined the codebase, not the build options, you're right. On SUSE:SLE-15:Update/exiv2 it seems we do not enable it as well:

exiv2.spec:119:  -DEXIV2_ENABLE_VIDEO:BOOL=OFF \

Closing the bug, nothing to fix.
Comment 4 OBSbugzilla Bot 2022-11-14 13:35:12 UTC
This is an autogenerated message for OBS integration:
This bug (1205391) was mentioned in
https://build.opensuse.org/request/show/1035633 Factory / exiv2
Comment 5 OBSbugzilla Bot 2022-11-14 23:35:08 UTC
This is an autogenerated message for OBS integration:
This bug (1205391) was mentioned in
https://build.opensuse.org/request/show/1035724 Factory / exiv2