[Pkg-kde-extras] Bug#910909: exiv2: CVE-2018-9145

[Salvatore Bonaccorso]

Source: exiv2
Version: 0.26-1
Severity: important
Tags: patch security upstream
Forwarded: https://github.com/Exiv2/exiv2/pull/470

Hi,

The following vulnerability was published for exiv2, affecting the
*experimental* version (0.26-1).

CVE-2018-9145[0]:
| In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an
| issue exists in the constructor with an initial buffer size. A large
| size value may lead to a SIGABRT during an attempt at memory
| allocation. NOTE: some third parties have been unable to reproduce the
| SIGABRT when using the 4-DataBuf-abort-1 PoC file.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-9145
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9145
[1] https://github.com/Exiv2/exiv2/pull/470
[2] https://github.com/Exiv2/exiv2/commit/c03f73268f65c73f9d3d7b670f13e48e92692750

Regards,
Salvatore