CVE-2021-22204

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image (CVE-2021-22204).

This update for perl-Image-ExifTool fixes the following issues:

Update to version 12.25 fixes (boo#1185547 CVE-2021-22204)

• JPEG XL support is now official
• Added read support for Medical Research Council (MRC) image files
• Added ability to write a number of 3gp tags in video files
• Added a new Sony PictureProfile value (thanks Jos Roost)
• Added a new Sony LensType (thanks LibRaw)
• Added a new Nikon LensID (thanks Niels Kristian Bech Jensen)
• Added a new Canon LensType
• Decode more GPS information from Blackvue dashcam videos
• Decode a couple of new NikonSettings tags (thanks Warren Hatch)
• Decode a few new RIFF tags
• Improved Validate option to add minor warning if standard XMP is missing xpacket wrapper
• Avoid decoding some large arrays in DNG images to improve performance unless the -m option is used
• Patched bug that could give runtime warning when trying to write an empty XMP structure
• Fixed decoding of ImageWidth/Height for JPEG XL images
• Fixed problem were Microsoft Xtra tags couldn't be deleted

version 12.24:

• Added a new PhaseOne RawFormat value (thanks LibRaw)
• Decode a new Sony tag (thanks Jos Roost)
• Decode a few new Panasonic and FujiFilm tags (thanks LibRaw and Greybeard)
• Patched security vulnerability in DjVu reader
• Updated acdsee.config in distribution (thanks StarGeek)
• Recognize AutoCAD DXF files
• More work on experimental JUMBF read support
• More work on experimental JPEG XL read/write support

version 12.23:

• Added support for Olympus ORI files
• Added experimental read/write support for JPEG XL images
• Added experimental read support for JUMBF metadata in JPEG and Jpeg2000 images
• Added built-in support for parsing GPS track from Denver ACG-8050 videos with the -ee option
• Added a some new Sony lenses (thanks Jos Roost and LibRaw)
• Changed priority of Samsung trailer tags so the first DepthMapImage takes precedence when -a is not used
• Improved identification of M4A audio files
• Patched to avoid escaping ',' in 'Binary data' message when -struct is used
• Removed Unknown flag from MXF VideoCodingSchemeID tag
• Fixed -forcewrite=EXIF to apply to EXIF in binary header of EPS files
• API Changes:
  • Added BlockExtract option

version 12.22:

• Added a few new Sony LensTypes and a new SonyModelID (thanks Jos Roost and LibRaw)
• Added Extra BaseName tag
• Added a new CanonModelID (thanks LibRaw)
• Decode timed GPS from unlisted programs in M2TS videos with the -ee3 option
• Decode more Sony rtmd tags
• Decode some tags for the Sony ILME-FX3 (thanks Jos Roost)
• Allow negative values to be written to XMP-aux:LensID
• Recognize HEVC video program in M2TS files
• Enhanced -b option so --b suppresses tags with binary data
• Improved flexibility when writing GPS coordinates:
  • Now pulls latitude and longitude from a combined GPSCoordinates string
  • Recognizes the full word 'South' and 'West' to write negative coordinates
• Improved warning when trying to write an integer QuickTime date/time tag and Time::Local is not available
• Convert GPSSpeed from mph to km/h in timed GPS from Garmin MP4 videos

version 12.21:

• Added a few new iOS QuickTime tags
• Decode a couple more Sony rtmd tags
• Patch to avoid possible 'Use of uninitialized value' warning when attempting to write QuickTime date/time tags with an invalid value
• Fixed problem writing Microsoft Xtra tags
• Fixed Windows daylight savings time patch for file times that was broken in 12.19 (however directory times will not yet handle DST properly)

version 12.20:

• Added ability to write some Microsoft Xtra tags in MOV/MP4 videos
• Added two new Canon LensType values (thanks Norbert Wasser)
• Added a new Nikon LensID
• Fixed problem reading FITS comments that start before column 11

version 12.19:

• Added -list_dir option
• Added the 'ls-l' Shortcut tag
• Extract Comment and History from FITS files
• Enhanced FilePermissions to include device type (similar to …

It was discovered that ExifTool did not properly sanitize user data for the DjVu file format. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code.

USN-4987-1 fixed a vulnerability in ExifTool. This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that ExifTool did not properly sanitize user data for the DjVu file format. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code.