Bugzilla – Bug 1142681
VUL-0: CVE-2019-13112: exiv2: uncontrolled memory allocation in PngChunk:parseChunkContent causing denial of service
Last modified: 2024-05-06 13:08:01 UTC
CVE-2019-13112 A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file. Reference: https://github.com/Exiv2/exiv2/issues/845 https://github.com/Exiv2/exiv2/pull/846 References: https://bugzilla.redhat.com/show_bug.cgi?id=1728490 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13112 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13112.html http://www.cvedetails.com/cve/CVE-2019-13112/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13112 https://github.com/Exiv2/exiv2/pull/846 https://github.com/Exiv2/exiv2/issues/845 https://usn.ubuntu.com/4056-1/
So on exiv 0.26 this is fixed via https://github.com/Exiv2/exiv2/pull/876/files which is already in the file exiv2-update-to-0.26-branch.patch that I added here: ------------------------------------------------------------------- Wed May 30 11:36:20 UTC 2018 - dmueller@suse.com - update to latest 0.26 branch: * obsoletes 0001-Use-more-GNUInstallDirs.patch d4e4288d839d0d9546a05986771f8738c382060c.patch gcc-version-check.patch 7f5b0778fa301b68c1c88e3820ec3afbd09dd0a5.patch fix-crash.patch * adds exiv2-update-to-0.26-branch.patch * Fixes CVE-2017-14864 (bsc#1060995), CVE-2017-14862 (bsc#1060996), CVE-2017-14859 (bsc#1061000) CVE-2017-14860 (bsc#1048883), CVE-2017-11337 (bsc#1048883), CVE-2017-11338 (bsc#1048883), CVE-2017-11339 (bsc#1048883), CVE-2017-11340 (bsc#1048883), CVE-2017-11553, CVE-2017-12955 (bsc#1054593), CVE-2017-12956, CVE-2017-12957, CVE-2017-11683, CVE-2017-11592, CVE-2017-11591 (bsc#1050257) I don't know why a year later a CVE got assigned, but the issue was already fixed back then. I added this to SLE11-SLE12
SUSE-SU-2022:4252-1: An update that fixes 8 vulnerabilities is now available. Category: security (important) Bug References: 1119562,1142681,1185002,1186231,1188733,1189332,1189337,1189338 CVE References: CVE-2018-20097,CVE-2019-13112,CVE-2021-29457,CVE-2021-29473,CVE-2021-31291,CVE-2021-32815,CVE-2021-34334,CVE-2021-37620 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): exiv2-0.23-12.18.1 SUSE OpenStack Cloud 9 (src): exiv2-0.23-12.18.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): exiv2-0.23-12.18.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): exiv2-0.23-12.18.1 SUSE Linux Enterprise Server 12-SP5 (src): exiv2-0.23-12.18.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): exiv2-0.23-12.18.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): exiv2-0.23-12.18.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): exiv2-0.23-12.18.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
All done, closing.