[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171123095313.ecfh63vqfwwmbzjp@home.ouaza.com>
Date: Thu, 23 Nov 2017 10:53:13 +0100
From: Raphael Hertzog <hertzog@...ian.org>
To: Hanno Böck <hanno@...eck.de>
Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: exiv2: multiple memory safety issues
Hello Hanno,
On Fri, 30 Jun 2017, Hanno Böck wrote:
> I have not reported thoses issues upstream. When I previously tried to
> report bugs in exiv2 found via fuzzing the upstream author made it
> clear to me that he has little interest in fixing those issues and
> doesn't consider his software suitable to parse defect files (which
> basically means it's unsuitable for untrusted input). The discussion
> can be read here [1]. (the page is sometimes not available, searching
> for it in the google cache usually works though)
>
> exiv2 is to my knowledge used by the major Linux Desktops GNOME and
> KDE. I'll also inform their security teams. I leave it up to Linux
> distros how to handle this, but it certainly is problematic that a
> crucial parser used by major desktop applications is not interested in
> fixing potential security issues.
>
> [1] http://dev.exiv2.org/issues/1248
FWIW, Robin Mills is moving away from exiv2, it is being handed over to
new developers and they have been rather responsive to the various
security issues that have been reported in the last months.
Search for CVE in https://github.com/Exiv2/exiv2/issues
So please file bugs on github, thank you.
I just add the CVE assigned through the Distributed Weakness Filing
Project.
> Heap overflow (write) in tiff parser
CVE-2017-1000127
> Heap out of bounds read in jp2 / JPEG2000 parser
CVE-2017-1000128
> Stack out of bounds read in webp parser
CVE-2017-1000126
Cheers,
--
Raphaël Hertzog ◈ Debian Developer
Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
