[ASA-202106-54] exiv2: multiple issues

[Jonas Witschel]

Arch Linux Security Advisory ASA-202106-54
==========================================

Severity: Low
Date    : 2021-06-22
CVE-ID  : CVE-2021-3482  CVE-2021-29457 CVE-2021-29458 CVE-2021-29463
          CVE-2021-29464 CVE-2021-29470 CVE-2021-29473 CVE-2021-29623
          CVE-2021-32617
Package : exiv2
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1772

Summary
=======

The package exiv2 before version 0.27.4-1 is vulnerable to multiple
issues including arbitrary code execution, denial of service and
information disclosure.

Resolution
==========

Upgrade to 0.27.4-1.

# pacman -Syu "exiv2>=0.27.4-1"

The problems have been fixed upstream in version 0.27.4.

Workaround
==========

None.

Description
===========

- CVE-2021-3482 (arbitrary code execution)

A security issue was found in Exiv2 in versions before version 0.27.4.
Improper input validation of the rawData.size property in
Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based
buffer overflow via a crafted JPG image containing malicious EXIF data.
An attacker could potentially exploit the vulnerability to gain code
execution, if they can trick the victim into running Exiv2 on a crafted
image file.

- CVE-2021-29457 (arbitrary code execution)

A heap buffer overflow was found in Exiv2 before version 0.27.4. The
heap overflow is triggered when Exiv2 is used to write metadata into a
crafted image file. An attacker could potentially exploit the
vulnerability to gain code execution, if they can trick the victim into
running Exiv2 on a crafted image file.

Note that this bug is only triggered when _writing_ the metadata, which
is a less frequently used Exiv2 operation than _reading_ the metadata.
For example, to trigger the bug in the Exiv2 command-line application,
you need to add an extra command-line argument such as insert.

- CVE-2021-29458 (denial of service)

An out-of-bounds read was found in Exiv2 before version 0.27.4. The
out-of-bounds read is triggered when Exiv2 is used to write metadata
into a crafted image file. An attacker could potentially exploit the
vulnerability to cause a denial of service by crashing Exiv2, if they
can trick the victim into running Exiv2 on a crafted image file.

Note that this bug is only triggered when writing the metadata, which
is a less frequently used Exiv2 operation than reading the metadata.
For example, to trigger the bug in the Exiv2 command-line application,
you need to add an extra command-line argument such as insert.

- CVE-2021-29463 (denial of service)

An out-of-bounds read was found in Exiv2 before version 0.27.4. The
out-of-bounds read is triggered when Exiv2 is used to write metadata
into a crafted image file. An attacker could potentially exploit the
vulnerability to cause a denial of service by crashing Exiv2, if they
can trick the victim into running Exiv2 on a crafted image file.

Note that this bug is only triggered when writing the metadata, which
is a less frequently used Exiv2 operation than reading the metadata.
For example, to trigger the bug in the Exiv2 command-line application,
you need to add an extra command-line argument such as insert.

- CVE-2021-29464 (arbitrary code execution)

A heap buffer overflow was found in Exiv2 before version 0.27.4. The
heap overflow is triggered when Exiv2 is used to write metadata into a
crafted image file. An attacker could potentially exploit the
vulnerability to gain code execution, if they can trick the victim into
running Exiv2 on a crafted image file.

Note that this bug is only triggered when writing the metadata, which
is a less frequently used Exiv2 operation than reading the metadata.
For example, to trigger the bug in the Exiv2 command-line application,
you need to add an extra command-line argument such as insert.

- CVE-2021-29470 (denial of service)

An out-of-bounds read was found in Exiv2 before version 0.27.4. The
out-of-bounds read is triggered when Exiv2 is used to write metadata
into a crafted image file. An attacker could potentially exploit the
vulnerability to cause a denial of service by crashing Exiv2, if they
can trick the victim into running Exiv2 on a crafted image file.

Note that this bug is only triggered when writing the metadata, which
is a less frequently used Exiv2 operation than reading the metadata.
For example, to trigger the bug in the Exiv2 command-line application,
you need to add an extra command-line argument such as insert.

- CVE-2021-29473 (denial of service)

An out-of-bounds read was found in Exiv2 before version 0.27.4. An
attacker could potentially exploit the vulnerability to cause a denial
of service by crashing Exiv2, if they can trick the victim into running
Exiv2 on a crafted image file.

Note that this bug is only triggered when writing the metadata, which
is a less frequently used Exiv2 operation than reading the metadata.
For example, to trigger the bug in the Exiv2 command-line application,
you need to add an extra command-line argument such as insert.

- CVE-2021-29623 (information disclosure)

A read of uninitialized memory was found in Exiv2 before version
0.27.4. The read of uninitialized memory is triggered when Exiv2 is
used to read the metadata of a crafted image file. An attacker could
potentially exploit the vulnerability to leak a few bytes of stack
memory, if they can trick the victim into running Exiv2 on a crafted
image file.

- CVE-2021-32617 (denial of service)

An inefficient algorithm (quadratic complexity) was found in Exiv2
before version 0.27.4. The inefficient algorithm is triggered when
Exiv2 is used to write metadata into a crafted image file. An attacker
could potentially exploit the vulnerability to cause a denial of
service, if they can trick the victim into running Exiv2 on a crafted
image file.

Note that this bug is only triggered when _writing_ the metadata, which
is a less frequently used Exiv2 operation than _reading_ the metadata.
For example, to trigger the bug in the Exiv2 command-line application,
you need to add an extra command-line argument such as rm.

Impact
======

Reading or writing EXIF metadata of a crafted image file could lead to
arbitrary code execution.

References
==========

https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jp9-m3fv-2vg9
https://github.com/Exiv2/exiv2/issues/1522
https://github.com/Exiv2/exiv2/pull/1523
https://github.com/Exiv2/exiv2/commit/22ea582c6b74ada30bec3a6b15de3c3e52f2b4da
https://github.com/Exiv2/exiv2/security/advisories/GHSA-v74w-h496-cgqm
https://github.com/Exiv2/exiv2/issues/1529
https://github.com/Exiv2/exiv2/pull/1534
https://github.com/Exiv2/exiv2/commit/13e5a3e02339b746abcaee6408893ca2fd8e289d
https://github.com/Exiv2/exiv2/security/advisories/GHSA-57jj-75fm-9rq5
https://github.com/Exiv2/exiv2/issues/1530
https://github.com/Exiv2/exiv2/pull/1536
https://github.com/Exiv2/exiv2/pull/1539
https://github.com/Exiv2/exiv2/commit/9b7a19f957af53304655ed1efe32253a1b11a8d0
https://github.com/Exiv2/exiv2/security/advisories/GHSA-5p8g-9xf3-gfrr
https://github.com/Exiv2/exiv2/pull/1577
https://github.com/Exiv2/exiv2/commit/d639e45c2cdc18b9b49b1307c6e4315277fa8cc4
https://github.com/Exiv2/exiv2/security/advisories/GHSA-jgm9-5fw5-pw9p
https://github.com/Exiv2/exiv2/pull/1576
https://github.com/Exiv2/exiv2/commit/0357f341e43f6e14123f227946574231ba379637
https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj
https://github.com/Exiv2/exiv2/pull/1581
https://github.com/Exiv2/exiv2/commit/f6ee71526eef5649a529ac6da3f2843e3b63e227
https://github.com/Exiv2/exiv2/security/advisories/GHSA-7569-phvm-vwc2
https://github.com/Exiv2/exiv2/pull/1587
https://github.com/Exiv2/exiv2/commit/e6a0982f7cd9282052b6e3485a458d60629ffa0b
https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v
https://github.com/Exiv2/exiv2/pull/1627
https://github.com/Exiv2/exiv2/commit/0f9eb74c44c908e170a64cab590949d53749af8e
https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj
https://github.com/Exiv2/exiv2/pull/1657
https://github.com/Exiv2/exiv2/commit/c261fbaa2567687eec6a595d3016212fd6ae648d
https://security.archlinux.org/CVE-2021-3482
https://security.archlinux.org/CVE-2021-29457
https://security.archlinux.org/CVE-2021-29458
https://security.archlinux.org/CVE-2021-29463
https://security.archlinux.org/CVE-2021-29464
https://security.archlinux.org/CVE-2021-29470
https://security.archlinux.org/CVE-2021-29473
https://security.archlinux.org/CVE-2021-29623
https://security.archlinux.org/CVE-2021-32617
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210624/2fe44c98/attachment.sig>