Debian Package Tracker

general

source: exiv2 (main)
version: 0.25-4
maintainer: Debian Qt/KDE Maintainers (archive) [DMD]
uploaders: Fathi Boudra [DMD] – Mark Purcell [DMD] – Maximiliano Curia [DMD]
arch: all any
std-ver: 4.1.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 0.24-4.1
old-sec: 0.24-4.1+deb8u3
stable: 0.25-3.1+deb9u1
stable-sec: 0.25-3.1+deb9u1
testing: 0.25-4
unstable: 0.25-4
exp: 0.26-1

versioned links

0.24-4.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.24-4.1+deb8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.25-3.1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.25-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.26-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

exiv2
libexiv2-14
libexiv2-dev
libexiv2-doc

action needed

A new upstream version is available: 0.27.1-RC1 high

A new upstream version 0.27.1-RC1 is available, you should consider packaging it.

Created: 2018-08-23 Last update: 2019-05-26 15:39

15 security issues in buster high

There are 15 open security issues in buster.

11 important issues:

CVE-2017-14864: An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2018-20097: There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
CVE-2018-19107: In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-based buffer over-read) caused by an integer overflow via a crafted PSD image file.
CVE-2018-16336: Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, a different vulnerability than CVE-2018-10999.
CVE-2018-19535: In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file.
CVE-2018-11037: In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file.
CVE-2018-19108: In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.
CVE-2017-14862: An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2017-17669: There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack.
CVE-2017-14859: An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2018-17581: CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service.

4 issues skipped by the security teams:

CVE-2018-9144: In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure.
CVE-2018-8976: In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.
CVE-2017-11591: There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
CVE-2017-18005: Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.

Please fix them.

Created: 2017-07-17 Last update: 2019-04-09 18:00

15 security issues in sid high

There are 15 open security issues in sid.

15 important issues:

CVE-2017-14864: An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2018-9144: In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure.
CVE-2018-8976: In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.
CVE-2017-11591: There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
CVE-2018-19535: In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file.
CVE-2018-19108: In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.
CVE-2017-14862: An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2018-20097: There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
CVE-2018-17581: CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service.
CVE-2018-19107: In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-based buffer over-read) caused by an integer overflow via a crafted PSD image file.
CVE-2018-16336: Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, a different vulnerability than CVE-2018-10999.
CVE-2018-11037: In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file.
CVE-2017-18005: Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.
CVE-2017-14859: An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2017-17669: There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack.

Please fix them.

Created: 2017-07-17 Last update: 2019-04-09 18:00

15 security issues in stretch high

There are 15 open security issues in stretch.

1 important issue:

CVE-2018-11037: In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file.

14 issues skipped by the security teams:

CVE-2017-14864: An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2018-9144: In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure.
CVE-2018-8976: In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.
CVE-2017-11591: There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
CVE-2018-19535: In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file.
CVE-2018-19108: In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.
CVE-2017-14862: An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2018-20097: There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
CVE-2018-17581: CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service.
CVE-2018-19107: In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-based buffer over-read) caused by an integer overflow via a crafted PSD image file.
CVE-2018-16336: Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file, a different vulnerability than CVE-2018-10999.
CVE-2017-18005: Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.
CVE-2017-14859: An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2017-17669: There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack.

Please fix them.

Created: 2017-07-17 Last update: 2019-04-09 18:00

lintian reports 1 error and 16 warnings high

Lintian reports 1 error and 16 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2015-03-05 Last update: 2019-03-12 04:37

7 bugs tagged patch in the BTS normal

The BTS contains patches fixing 7 bugs, consider including or untagging them.

Created: 2019-04-01 Last update: 2019-05-26 18:10

Multiarch hinter reports 2 issue(s) normal

There are issues with the multiarch metadata for this package.

libexiv2-doc could be marked Multi-Arch: foreign
libexiv2-dev could be marked Multi-Arch: same

Created: 2016-09-14 Last update: 2019-05-26 15:46

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2018-09-11 Last update: 2019-05-26 15:45

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 0.26-2~, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 832c7cdfe08e86320e784def0bc46045fb271df4
Author: Maximiliano Curia <maxy@gnuservers.com.ar>
Date:   Tue Oct 31 18:04:30 2017 +0100

    Update changelog for 0.26-2~ release

commit ce9d0986cc60051b389122427252f4bcf1f83eb6
Author: Maximiliano Curia <maxy@gnuservers.com.ar>
Date:   Tue Oct 31 18:04:28 2017 +0100

    Update uploaders list as requested by MIA team
    
    Closes: #879288

The Vcs URL is using anonscm.debian.org. Please update it for the move to salsa.debian.org.

Created: 2017-12-03 Last update: 2019-05-26 00:11

9 ignored security issues in jessie low

There are 9 open security issues in jessie.

9 issues skipped by the security teams:

CVE-2017-14864: An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2018-9144: In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure.
CVE-2018-8976: In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file.
CVE-2017-14859: An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2017-11591: There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.
CVE-2017-9239: An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone must open a crafted tiff file.
CVE-2017-17669: There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack.
CVE-2017-14862: An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service.
CVE-2017-18005: Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file.

Please fix them.

Created: 2017-05-26 Last update: 2019-04-09 18:00

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2017-02-25 Last update: 2017-02-25 13:12

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.3.0 instead of 4.1.4).

Created: 2018-08-20 Last update: 2018-12-23 17:15

testing migrations

This package will soon be part of the auto-exiv2 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2019-02-26] Accepted exiv2 0.24-4.1+deb8u3 (source amd64 all) into oldstable (Thorsten Alteholz)
[2018-10-21] Accepted exiv2 0.24-4.1+deb8u2 (source all) into oldstable (Roberto C. Sanchez)
[2018-07-04] Accepted exiv2 0.25-3.1+deb9u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Roberto C. Sanchez)
[2018-07-04] exiv2 0.25-4 MIGRATED to testing (Debian testing watch)
[2018-07-03] Accepted exiv2 0.25-3.1+deb9u1 (source amd64 all) into stable->embargoed, stable (Roberto C. Sanchez)
[2018-06-28] Accepted exiv2 0.25-4 (source) into unstable (Maximiliano Curia)
[2018-06-28] Accepted exiv2 0.24-4.1+deb8u1 (source all) into oldstable (Roberto C. Sanchez)
[2017-10-26] Accepted exiv2 0.23-1+deb7u2 (source amd64 all) into oldoldstable (Raphaël Hertzog)
[2017-07-17] Accepted exiv2 0.26-1 (source amd64 all) into experimental, experimental (Maximiliano Curia)
[2017-06-08] exiv2 0.25-3.1 MIGRATED to testing (Debian testing watch)
[2017-06-05] Accepted exiv2 0.25-3.1 (source amd64 all) into unstable (Moritz Muehlenhoff) (signed by: Moritz Mühlenhoff)
[2017-05-29] Accepted exiv2 0.23-1+deb7u1 (source amd64 all) into oldstable (Emilio Pozuelo Monfort)
[2016-05-24] exiv2 0.25-3 MIGRATED to testing (Debian testing watch)
[2016-05-18] Accepted exiv2 0.25-3 (source) into unstable (Norbert Preining) (signed by: Maximiliano Curia)
[2015-10-13] exiv2 0.25-2.1 MIGRATED to testing (Britney)
[2015-10-08] Accepted exiv2 0.25-2.1 (source amd64 all) into unstable (YunQiang Su)
[2015-09-06] exiv2 0.25-2 MIGRATED to testing (Britney)
[2015-08-06] Accepted exiv2 0.25-2 (source amd64 all) into unstable (Maximiliano Curia)
[2015-08-05] Accepted exiv2 0.25-1 (source amd64 all) into unstable, unstable (Maximiliano Curia)
[2015-01-16] exiv2 0.24-4.1 MIGRATED to testing (Britney)
[2015-01-09] Accepted exiv2 0.24-4.1 (source amd64 all) into unstable (Salvatore Bonaccorso)
[2014-09-11] exiv2 0.24-4 MIGRATED to testing (Britney)
[2014-09-05] Accepted exiv2 0.24-4 (source amd64 all) into unstable (Pino Toscano)
[2014-08-28] Accepted exiv2 0.24-3 (source amd64 all) into experimental (Pino Toscano)
[2014-08-16] exiv2 0.23-1.1 MIGRATED to testing (Britney)
[2014-08-05] Accepted exiv2 0.23-1.1 (source amd64 all) into unstable (Wookey)
[2014-01-17] Accepted exiv2 0.24-2 (source amd64 all) (Pino Toscano)
[2013-12-15] Accepted exiv2 0.24-1 (source i386 all) (Mark Purcell)
[2012-05-10] exiv2 0.23-1 MIGRATED to testing (Debian testing watch)
[2012-05-06] Accepted exiv2 0.23-1 (source all amd64) (Mark Purcell)

bugs [bug history graph]

all: 52
RC: 21
I&N: 28
M&W: 2
F&P: 1
patch: 7
NC: 1

links

homepage
buildd: logs, exp, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.25-4ubuntu1
5 bugs
patches for 0.25-4ubuntu1