{"id":"CLSA-2026-1787305055","summary":"Fix CVE(s): CVE-2026-32775, CVE-2026-40385, CVE-2026-40386","details":"   * SECURITY UPDATE: out-of-bounds write in MakerNote value formatting\n     - debian/patches/CVE-2026-32775.patch: reject maxlen == 0 before the\n       maxlen-- underflow in mnote_canon_entry_get_value(),\n       mnote_fuji_entry_get_value(), mnote_olympus_entry_get_value() and\n       mnote_pentax_entry_get_value().\n     - CVE-2026-32775\n   * SECURITY UPDATE: integer overflow when reading Nikon MakerNotes\n     - debian/patches/CVE-2026-40385.patch: bound the offset read from the\n       MakerNote before adding it to datao in\n       exif_mnote_data_olympus_load(), which could wrap on 32-bit size_t\n       and lead to out-of-bounds reads.\n     - CVE-2026-40385\n   * SECURITY UPDATE: unsigned integer underflow in MakerNote tag lookup\n     - debian/patches/CVE-2026-40386.patch: use \"i \u003e= n-\u003ecount\" instead of\n       \"i \u003e n-\u003ecount - 1\" in exif_mnote_data_fuji_get_value() and\n       exif_mnote_data_olympus_get_value(), which underflowed when count\n       was 0.\n     - CVE-2026-40386","modified":"2026-10-26T09:31:47.557842542Z","published":"2026-08-21T09:37:47Z","upstream":["CVE-2026-32775","CVE-2026-40385","CVE-2026-40386"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787305055.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32775"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40385"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40386"}],"affected":[{"package":{"name":"libexif-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libexif-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.21-4ubuntu0.6+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787305055.json"}},{"package":{"name":"libexif-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libexif-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.21-4ubuntu0.6+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787305055.json"}},{"package":{"name":"libexif12","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libexif12?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.21-4ubuntu0.6+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787305055.json"}}],"schema_version":"1.9.0"}