Date: Thu, 23 Nov 2017 10:53:13 +0100 From: Raphael Hertzog <hertzog@...ian.org> To: Hanno Böck <hanno@...eck.de> Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: Re: exiv2: multiple memory safety issues Hello Hanno, On Fri, 30 Jun 2017, Hanno Böck wrote: > I have not reported thoses issues upstream. When I previously tried to > report bugs in exiv2 found via fuzzing the upstream author made it > clear to me that he has little interest in fixing those issues and > doesn't consider his software suitable to parse defect files (which > basically means it's unsuitable for untrusted input). The discussion > can be read here . (the page is sometimes not available, searching > for it in the google cache usually works though) > > exiv2 is to my knowledge used by the major Linux Desktops GNOME and > KDE. I'll also inform their security teams. I leave it up to Linux > distros how to handle this, but it certainly is problematic that a > crucial parser used by major desktop applications is not interested in > fixing potential security issues. > >  http://dev.exiv2.org/issues/1248 FWIW, Robin Mills is moving away from exiv2, it is being handed over to new developers and they have been rather responsive to the various security issues that have been reported in the last months. Search for CVE in https://github.com/Exiv2/exiv2/issues So please file bugs on github, thank you. I just add the CVE assigned through the Distributed Weakness Filing Project. > Heap overflow (write) in tiff parser CVE-2017-1000127 > Heap out of bounds read in jp2 / JPEG2000 parser CVE-2017-1000128 > Stack out of bounds read in webp parser CVE-2017-1000126 Cheers, -- Raphaël Hertzog ◈ Debian Developer Support Debian LTS: https://www.freexian.com/services/debian-lts.html Learn to master Debian: https://debian-handbook.info/get/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ