Multiple vulnerabilities have been found in Exiv2, the worst of which can lead to a crash via Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/exiv2 | * | < 0.28.8 | >= 0.28.8 |
Exiv2 is a C++ library and set of tools for parsing, editing and saving Exif and IPTC metadata from images.
The following vulnerabilities have been discovered in Exiv2: 2 out of bounds reads, an integer overflow, and an uncaught exception. The worst of which can lead to a Denial of Service via a crash of the program. Please review the CVE identifiers referenced below for details.
The following is a possible outcome: data leakage via an out-of-bounds read or a Denial of Service via a crash of the program.
Avoid using the CLI tool, exiv2, with untrusted files.
All Exiv2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.28.8"
Multiple vulnerabilities have been discovered in Exiv2, the worst of which can lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/exiv2 | * | < 0.28.1 | >= 0.28.1 |
Exiv2 is a C++ library and set of tools for parsing, editing and saving Exif and IPTC metadata from images. Exif, the Exchangeable image file format, specifies the addition of metadata tags to JPEG, TIFF and RIFF files.
Multiple vulnerabilities have been discovered in Exiv2. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Exiv2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.28.1"
Multiple vulnerabilities have been found in Exiv2, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/exiv2 | * | < 0.26_p20180811-r3 | >= 0.26_p20180811-r3 |
Exiv2 is a C++ library and a command line utility to manage image metadata.
Multiple vulnerabilities have been discovered in Exiv2. Please review the CVE identifiers referenced below for details.
A remote attacker could cause a Denial of Service condition or obtain sensitive information via a specially crafted file.
There is no known workaround at this time.
All Exiv2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.26_p20180811-r3"
A vulnerability in Exiv2 could lead to Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/exiv2 | * | < 0.24-r1 | >= 0.24-r1 |
Exiv2 is a C++ library and a command line utility to manage image metadata.
Exiv2 has a buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp.
A remote attacker could possibly cause a Denial of Service condition via a specially crafted AVI file with IKEY INFO tag.
There is no known workaround at this time.
All Exiv2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.24-r1"
An integer overflow vulnerability in Exiv2 possibly allows for the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/exiv2 | * | < 0.13-r1 | >= 0.13-r1 |
Exiv2 is a C++ library and set of tools for parsing, editing and saving Exif and IPTC metadata from images. Exif, the Exchangeable image file format, specifies the addition of metadata tags to JPEG, TIFF and RIFF files.
Meder Kydyraliev (Google Security) discovered an integer overflow vulnerability in the JpegThumbnail::setDataArea() method leading to a heap-based buffer overflow.
An attacker could entice the user of an application making use of Exiv2 or an application included in Exiv2 to load an image file with specially crafted Exif tags, possibly resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Exiv2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.13-r1"