CLSA-2026-1787932207
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787932207.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787932207
- Upstream
- Published
- 2026-09-01T10:59:33Z
- Modified
- 2026-10-26T09:32:03Z
- Summary
- Fix CVE(s): CVE-2020-18771, CVE-2026-25884, CVE-2026-27596
- Details
-
- SECURITY UPDATE: out-of-bounds read in the Nikon MakerNote printer
- debian/patches/CVE-2020-18771.patch: bound the nikonFocusarea[] index in Nikon1MakerNote::print0x0088() with EXV_COUNTOF(), so a crafted MakerNote cannot make the printer read a pointer from past the end of the table (upstream 5e6c2855ce, via Debian DLA-3265-1).
- CVE-2020-18771
- SECURITY UPDATE: out-of-bounds read in the native preview loader
- debian/patches/CVE-2026-27596.patch: require sizeData >= 28 in LoaderNative::getData() before subtracting 28, so a Photoshop preview IRB declaring a shorter payload cannot wrap the length to nearly 4 GB (upstream 2cb728a850).
- CVE-2026-27596
- SECURITY UPDATE: out-of-bounds read in the Nikon MakerNote printer
- References
Affected packages
TuxCare:Ubuntu:18.04 / exiv2
Package
- Name
- exiv2
- Purl
- pkg:deb/tuxcare/exiv2?distro=ubuntu-18.04
TuxCare:Ubuntu:18.04 / libexiv2-14
Package
- Name
- libexiv2-14
- Purl
- pkg:deb/tuxcare/libexiv2-14?distro=ubuntu-18.04
TuxCare:Ubuntu:18.04 / libexiv2-dev
Package
- Name
- libexiv2-dev
- Purl
- pkg:deb/tuxcare/libexiv2-dev?distro=ubuntu-18.04