From ac054647254eb13d0b84b78ceab28ba69d92c404 Mon Sep 17 00:00:00 2001
From: GLSAMaker <glsamaker@gentoo.org>
Date: Fri, 22 Dec 2023 09:22:44 +0000
Subject: [ GLSA 202312-06 ] Exiv2: Multiple Vulnerabilities

Bug: https://bugs.gentoo.org/785646
Bug: https://bugs.gentoo.org/807346
Bug: https://bugs.gentoo.org/917650
Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
Signed-off-by: Hans de Graaff <graaff@gentoo.org>
---
 glsa-202312-06.xml | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 glsa-202312-06.xml

diff --git a/glsa-202312-06.xml b/glsa-202312-06.xml
new file mode 100644
index 00000000..9943781b
--- /dev/null
+++ b/glsa-202312-06.xml
@@ -0,0 +1,69 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="202312-06">
+    <title>Exiv2: Multiple Vulnerabilities</title>
+    <synopsis>Multiple vulnerabilities have been discovered in Exiv2, the worst of which can lead to remote code execution.</synopsis>
+    <product type="ebuild">exiv2</product>
+    <announced>2023-12-22</announced>
+    <revised count="1">2023-12-22</revised>
+    <bug>785646</bug>
+    <bug>807346</bug>
+    <bug>917650</bug>
+    <access>local and remote</access>
+    <affected>
+        <package name="media-gfx/exiv2" auto="yes" arch="*">
+            <unaffected range="ge">0.28.1</unaffected>
+            <vulnerable range="lt">0.28.1</vulnerable>
+        </package>
+    </affected>
+    <background>
+        <p>Exiv2 is a C++ library and set of tools for parsing, editing and saving Exif and IPTC metadata from images. Exif, the Exchangeable image file format, specifies the addition of metadata tags to JPEG, TIFF and RIFF files.</p>
+    </background>
+    <description>
+        <p>Multiple vulnerabilities have been discovered in Exiv2. Please review the CVE identifiers referenced below for details.</p>
+    </description>
+    <impact type="high">
+        <p>Please review the referenced CVE identifiers for details.</p>
+    </impact>
+    <workaround>
+        <p>There is no known workaround at this time.</p>
+    </workaround>
+    <resolution>
+        <p>All Exiv2 users should upgrade to the latest version:</p>
+        
+        <code>
+          # emerge --sync
+          # emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.28.1"
+        </code>
+    </resolution>
+    <references>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-18771">CVE-2020-18771</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-18773">CVE-2020-18773</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-18774">CVE-2020-18774</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2020-18899">CVE-2020-18899</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29457">CVE-2021-29457</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29458">CVE-2021-29458</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29463">CVE-2021-29463</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29464">CVE-2021-29464</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29470">CVE-2021-29470</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29473">CVE-2021-29473</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-29623">CVE-2021-29623</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-31291">CVE-2021-31291</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-31292">CVE-2021-31292</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-32617">CVE-2021-32617</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-32815">CVE-2021-32815</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-34334">CVE-2021-34334</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-34335">CVE-2021-34335</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37615">CVE-2021-37615</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37616">CVE-2021-37616</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37618">CVE-2021-37618</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37619">CVE-2021-37619</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37620">CVE-2021-37620</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37621">CVE-2021-37621</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37622">CVE-2021-37622</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-37623">CVE-2021-37623</uri>
+        <uri link="https://nvd.nist.gov/vuln/detail/CVE-2023-44398">CVE-2023-44398</uri>
+    </references>
+    <metadata tag="requester" timestamp="2023-12-22T09:22:44.942530Z">graaff</metadata>
+    <metadata tag="submitter" timestamp="2023-12-22T09:22:44.945110Z">graaff</metadata>
+</glsa>
\ No newline at end of file
-- 
cgit v1.2.3-65-gdbad