UBUNTU-CVE-2026-40311

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions below 7.1.2-19 and 6.9.13-44 contain a heap use-after-free vulnerability that can cause a crash when reading and printing values from an invalid XMP profile. This issue has been fixed in versio...

GHSA-3CRG-W4F6-42MX pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. Patches This has been fixed in pypdf==6.10.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3724...

PT-2026-32055

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.10.0 Description Manipulated XMP metadata entity declarations can exhaust RAM. An attacker can craft a PDF that leads to large memory usage when the XMP metadata is parsed. Recommendations Update to version 6.10.0. As...

CVE-2026-24043

A flaw was found in jsPDF, a JavaScript library for generating PDFs. A remote attacker can inject arbitrary Extensible Metadata Platform XMP metadata into a generated PDF by providing unsanitized input to the addMetadata function. This XML injection vulnerability can compromise the integrity of t...

CVE-2026-24043 jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the...

ImageMagick 安全漏洞

ImageMagick is a suite of open source image processing software from ImageMagick Open Source. It can read, convert or write images in many formats. A security vulnerability exists in versions prior to ImageMagick 7.1.2-0 that stems from an infinite loop in a specific XMP file conversion command...

Adobe XMP Toolkit 缓冲区错误漏洞

Adobe XMP Toolkit is a toolkit from the American company Audobee Adobe. Used to integrate Xmp functionality into a product or solution. Adobe XMP Toolkit suffers from a buffer overflow vulnerability that originates from an out-of-bounds read, which can be exploited by an attacker to cause a...

SUSE CVE-2015-2942

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service CPU and memory consumption via a large number of nested entity references in an 1 SVG file or 2 XMP metadata in a PDF file, aka a "billion laughs attack," ...

CVE-2021-23792

The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity XXE Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file e.g. when an online profile...

TwelveMonkeys ImageIO 代码问题漏洞

TwelveMonkeys ImageIO is an add-on plug-in and extension for ImageIO for Java from the Norwegian individual developer Harald Kuhr. A security vulnerability exists in TwelveMonkeys ImageIO versions prior to 3.7.1, which stems from an insecure initialization of the XML parser that reads XMP metadat...

The vulnerability of the Adobe XMP-Toolkit-SDK software, related to breaching the initial buffer boundary, allows a perpetrator to execute arbitrary code in the context of the current user.

The vulnerability of the Adobe XMP-Toolkit-SDK lies in the violation of the buffer’s initial boundary. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in the context of the current user, through a specially created application...

The vulnerability of the Adobe XMP-Toolkit-SDK software, related to buffer overflows in the stack, allows a hacker to execute arbitrary code.

The vulnerability of the Adobe XMP-Toolkit-SDK software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

The vulnerability of the software for creating metadata, processing, and exchanging data according to the Adobe XMP-Toolkit-SDK standards, related to reading beyond the buffer in memory, allows attackers to disclose protected information.

The vulnerability of the software for creating metadata, processing, and exchanging data according to the Adobe XMP-Toolkit-SDK is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

UBUNTU-CVE-2021-39847

XMP Toolkit SDK version 2020.1 and earlier is affected by a stack-based buffer overflow vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file...

UBUNTU-CVE-2021-36055

XMP Toolkit SDK versions 2020.1 and earlier are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PYSEC-2021-34

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries...

UBUNTU-CVE-2017-18233

An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service infinite loop via crafted XMP data in a .avi file...

UBUNTU-CVE-2015-2942

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service CPU and memory consumption via a large number of nested entity references in an 1 SVG file or 2 XMP metadata in a PDF file, aka a "billion laughs attack," ...

Fedora Update for monotone FEDORA-2010-16902

Check for the Version of monotone OpenVAS Vulnerability Test Fedora Update for monotone FEDORA-2010-16902 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...