Exiv2 0.28.7 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(301135);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/16");

  script_cve_id("CVE-2026-25884", "CVE-2026-27596", "CVE-2026-27631");
  script_xref(name:"IAVA", value:"2026-A-0190");

  script_name(english:"Exiv2 0.28.7 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Exiv2 installed on the remote host is 0.28.7. It is, therefore, affected by multiple vulnerabilities:

  - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC 
    image metadata. In version 0.28.7, an out-of-bounds read was found. The vulnerability is in the CRW image
    parser. (CVE-2026-25884)

  - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC 
    image metadata. In version 0.28.7, an out-of-bounds read was found in Exiv2. The vulnerability is in 
    the preview component, which is only triggered when running Exiv2 with an extra command line argument, 
    like -pp. The out-of-bounds read is at a 4GB offset, which usually causes Exiv2 to crash. (CVE-2026-27596)

  - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC
    image metadata. In version 0.28.7, an uncaught exception was found in Exiv2. The vulnerability is in
    the preview component, which is only triggered when running Exiv2 with an extra command line argument,
    like -pp. Due to an integer overflow, the code attempts to create a huge std::vector, which causes Exiv2
    to crash with an uncaught exception. (CVE-2026-27631)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/Exiv2/exiv2/security/advisories/GHSA-9mxq-4j5g-5wrp");
  script_set_attribute(attribute:"see_also", value:"https://github.com/Exiv2/exiv2/security/advisories/GHSA-3wgv-fg4w-75x7");
  script_set_attribute(attribute:"see_also", value:"https://github.com/Exiv2/exiv2/security/advisories/GHSA-p2pw-7935-c73j");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Exiv2 version 0.28.8 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-25884");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-27631");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:exiv2:exiv2");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("exiv2_nix_installed.nbin");
  script_require_keys("installed_sw/Exiv2");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'Exiv2');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'equal' : '0.28.7', 'fixed_version' : '0.28.8' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);