Ubuntu
exiv2 package

[libexiv2] [CVE-2007-6353] possibility of arbitrary code execution

  1. Dapper (6.06)
  2. Bug #181714
Bug #181714 reported by disabled.user
254
Affects Status Importance Assigned to Milestone
exiv2 (Debian)
Fix Released
Unknown
exiv2 (Ubuntu)
Fix Released
Undecided
Unassigned
Dapper
Won't Fix
Medium
Unassigned
Feisty
Fix Released
Medium
Kees Cook
Gutsy
Fix Released
Medium
Kees Cook

Bug Description

Binary package hint: libexiv2-0

References:
SUSE-SR:2008:001

Quoting:
"Meder Kydyraliev of Google found out that specially crafted
files could trigger an integer overflow in the libexiv2 library,
potentially causing code execution (CVE-2007-6353)."

CVE References

Bug Watch Updater (bug-watch-updater)
Changed in exiv2:
status: Unknown → Fix Released
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Fixed in 0.16, hardy has 0.16-3ubuntu1

Changed in exiv2:
status: New → Fix Released
Revision history for this message
Kees Cook (kees) wrote :

This problem has been addressed with the following USN:

http://www.ubuntu.com/usn/usn-655-1

Please feel free to report future bugs.

Changed in exiv2:
importance: Undecided → Low
status: New → Confirmed
assignee: nobody → kees
importance: Undecided → Medium
status: New → Fix Released
assignee: nobody → kees
importance: Undecided → Medium
status: New → Fix Released
importance: Low → Medium
status: Confirmed → Triaged
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

Changed in exiv2 (Ubuntu Dapper):
status: Triaged → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.