Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Nov 2017 10:53:13 +0100
From: Raphael Hertzog <>
To: Hanno Böck <>
Cc: "" <>
Subject: Re: exiv2: multiple memory safety issues

Hello Hanno,

On Fri, 30 Jun 2017, Hanno Böck wrote:
> I have not reported thoses issues upstream. When I previously tried to
> report bugs in exiv2 found via fuzzing the upstream author made it
> clear to me that he has little interest in fixing those issues and
> doesn't consider his software suitable to parse defect files (which
> basically means it's unsuitable for untrusted input). The discussion
> can be read here [1]. (the page is sometimes not available, searching
> for it in the google cache usually works though)
> exiv2 is to my knowledge used by the major Linux Desktops GNOME and
> KDE. I'll also inform their security teams. I leave it up to Linux
> distros how to handle this, but it certainly is problematic that a
> crucial parser used by major desktop applications is not interested in
> fixing potential security issues.
> [1]

FWIW, Robin Mills is moving away from exiv2, it is being handed over to
new developers and they have been rather responsive to the various
security issues that have been reported in the last months.

Search for CVE in

So please file bugs on github, thank you.

I just add the CVE assigned through the Distributed Weakness Filing

> Heap overflow (write) in tiff parser

> Heap out of bounds read in jp2 / JPEG2000 parser


> Stack out of bounds read in webp parser


Raphaël Hertzog ◈ Debian Developer

Support Debian LTS:
Learn to master Debian:

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.