gentoo-overlay/metadata/glsa/glsa-202312-06.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="202312-06">
    <title>Exiv2: Multiple Vulnerabilities</title>
    <synopsis>Multiple vulnerabilities have been discovered in Exiv2, the worst of which can lead to remote code execution.</synopsis>
    <product type="ebuild">exiv2</product>
    <announced>2023-12-22</announced>
    <revised count="1">2023-12-22</revised>
    <bug>785646</bug>
    <bug>807346</bug>
    <bug>917650</bug>
    <access>local and remote</access>
    <affected>
        <package name="media-gfx/exiv2" auto="yes" arch="*">
            <unaffected range="ge">0.28.1</unaffected>
            <vulnerable range="lt">0.28.1</vulnerable>
        </package>
    </affected>
    <background>
        <p>Exiv2 is a C++ library and set of tools for parsing, editing and saving Exif and IPTC metadata from images. Exif, the Exchangeable image file format, specifies the addition of metadata tags to JPEG, TIFF and RIFF files.</p>
    </background>
    <description>
        <p>Multiple vulnerabilities have been discovered in Exiv2. Please review the CVE identifiers referenced below for details.</p>
    </description>
    <impact type="high">
        <p>Please review the referenced CVE identifiers for details.</p>
    </impact>
    <workaround>
        <p>There is no known workaround at this time.</p>
    </workaround>
    <resolution>
        <p>All Exiv2 users should upgrade to the latest version:</p>
        
        <code>
          # emerge --sync
          # emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.28.1"
        </code>
    </resolution>
    <references>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-18771">CVE-2020-18771</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-18773">CVE-2020-18773</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-18774">CVE-2020-18774</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-18899">CVE-2020-18899</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29457">CVE-2021-29457</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29458">CVE-2021-29458</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29463">CVE-2021-29463</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29464">CVE-2021-29464</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29470">CVE-2021-29470</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29473">CVE-2021-29473</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29623">CVE-2021-29623</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-31291">CVE-2021-31291</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-31292">CVE-2021-31292</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-32617">CVE-2021-32617</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-32815">CVE-2021-32815</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-34334">CVE-2021-34334</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-34335">CVE-2021-34335</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37615">CVE-2021-37615</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37616">CVE-2021-37616</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37618">CVE-2021-37618</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37619">CVE-2021-37619</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37620">CVE-2021-37620</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37621">CVE-2021-37621</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37622">CVE-2021-37622</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37623">CVE-2021-37623</uri>
        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-44398">CVE-2023-44398</uri>
    </references>
    <metadata tag="requester" timestamp="2023-12-22T09:22:44.942530Z">graaff</metadata>
    <metadata tag="submitter" timestamp="2023-12-22T09:22:44.945110Z">graaff</metadata>
</glsa>