==========================================================================
Ubuntu Security Notice USN-4056-1
July 15, 2019

exiv2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 19.04
– Ubuntu 18.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Exiv2.

Software Description:
– exiv2: EXIF/IPTC/XMP metadata manipulation tool

Details:

It was discovered that Exiv2 incorrectly handled certain PSD files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2018-19107, CVE-2018-19108)

It was discovered that Exiv2 incorrectly handled certain PNG files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2018-19535, CVE-2019-13112)

It was discovered that Exiv2 incorrectly handled certain CRW files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-13110, CVE-2019-13113)

It was discovered that incorrectly handled certain HTTP requests.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-13114)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
exiv2 0.25-4ubuntu1.1
libexiv2-14 0.25-4ubuntu1.1

Ubuntu 18.10:
exiv2 0.25-4ubuntu0.2
libexiv2-14 0.25-4ubuntu0.2

Ubuntu 18.04 LTS:
exiv2 0.25-3.1ubuntu0.18.04.3
libexiv2-14 0.25-3.1ubuntu0.18.04.3

Ubuntu 16.04 LTS:
exiv2 0.25-2.1ubuntu16.04.4
libexiv2-14 0.25-2.1ubuntu16.04.4

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4056-1
CVE-2018-19107, CVE-2018-19108, CVE-2018-19535, CVE-2019-13110,
CVE-2019-13112, CVE-2019-13113, CVE-2019-13114

Package Information:
https://launchpad.net/ubuntu/+source/exiv2/0.25-4ubuntu1.1
https://launchpad.net/ubuntu/+source/exiv2/0.25-4ubuntu0.2
https://launchpad.net/ubuntu/+source/exiv2/0.25-3.1ubuntu0.18.04.3
https://launchpad.net/ubuntu/+source/exiv2/0.25-2.1ubuntu16.04.4
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBAgAGBQJdLJDsAAoJEEW851uECx9pyPAP/j3sj/R3B15H8fK/r/OVTmIi
cpVkqo3TVa9Rbw71JG/Ed451uKpl2ee0LPGcRsqVBQZBX8//sPjL0oyBEhf0KZ+t
IpDwVokWzYg6NrfGoTrx01bJGNqBZPYigxZtHj8pNp8pSkELYNxEMUD5KZOOng8X
bEDCjeZznIFX+McPiQ8Fh+Y32W2waVaVtB7ilLeW+OqcHq7gv08our7AfbuHOQvC
5+tD4JK4iA0Xko3mUm4kKd7uMAxIA8Whq5ugOJgQ0a2hXVwWf8AD7y7ViVXQCdYm
hWXZeKsUZITelJLtHCXgZMNaj+U+iOJTXS4jSDRZ6iYyPlt1EeweP+7Uvontt74h
2xnI74p67G1CqaeztlVXdbY0T9g7k+oQ0oPHYlxSyCrqaIsiOJpkI8/uyLD5zv1O
Uuj/C/wGfRRK2pucX+0i0YzMMLTHS8MlynCliVyfaVyOD6p3w79kqmaRev1xUEBf
HDnSVcfybUjgHw5tVTAmCvGlpzK6jrzVX/h3T/4La+amk57JS7Ju0zPk/lR2+hjI
WS705KPgM3HHb6zub3FtSF6GKq2QfTx6qg1YIJ52cjVNxgrziHL1rgJEWGyKpHOy
Ds3n/kZLA/EXEF7QzQG5Zm0KO3W9b97TCLykLEI4LZmouomM5+5BMl/ZyUDOZAhv
WnDtXMrtJqsvcWonAYGB
=dY9G
—–END PGP SIGNATURE—–
—