exiv2 security, bug fix, and enhancement update

An update is available for libgexiv2, gnome-color-manager, gegl, exiv2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The exiv2 packages provide a command line...

Command Injection

Overview im-metadata is a package to retrieve image metadata as a JSON object using ImageMagick's identify command. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the metadata options which is given to the exec functio...

PYSEC-2020-344

In Jp2Image::readMetadata in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file...

UBUNTU-CVE-2019-11047

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure o...

PT-2019-4729 · Php +7 · Php +7

Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.25 PHP versions 7.3.x through 7.3.12 PHP version 7.4.0 Description: The issue is caused by a buffer overflow in the exif read data function of the PHP interpreter. This can allow a remote attacker to disclose...

php: Heap buffer over-read in exif_scan_thumbnail()

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information...

exiv2 security update

CentOS Errata and Security Advisory CESA-2019:2101 An update for exiv2 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.1.14 security and bug fix update

An update is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

php: Uninitialized read in exif_process_IFD_in_MAKERNOTE

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exifprocessIFDinMAKERNOTE because of mishandling the datalen variable...

php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exifprocessIFDTAG function. This may lead to information disclosure or crash...

php: Invalid read in exif_process_SOFn()

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exifprocessSOFn...

php: Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data

An out-of-bounds read has been found in PHP when function exifiifaddvalue handles the case of a MakerNote that lacks a final terminator character. A remote attacker could use this vulnerability to cause a crash...

Exiv2 Input Validation Error Vulnerability (CNVD-2019-34823)

Exiv2 is a set of C++ libraries and command line applications for managing image metadata by Andreas Huggel programmers. The product provides the ability to read and write image metadata in a variety of formats including EXIF, IPTC and XMP. An input validation error vulnerability exists in Exiv2...

[SECURITY] Fedora 30 Update: exiv2-0.27.2-1.fc30

A command line utility to access image metadata, allowing one to: print the Exif metadata of Jpeg images as summary info, interpreted value s, or the plain data for each tag print the Iptc metadata of Jpeg images print the Jpeg comment of Jpeg images set, add and delete Exif and Iptc metadata of...

Exiv2 Buffer Overflow Vulnerability (CNVD-2019-34612)

Exiv2 is a set of C++ libraries and command line applications for managing image metadata by Andreas Huggel programmers. The product provides the ability to read and write image metadata in a variety of formats including EXIF, IPTC and XMP. A buffer overflow vulnerability exists in Exiv2. An...

MetadataExtractor Stack Overflow Vulnerability

MetadataExtractor is a .NET library for extracting metadata such as Exif, IPT, XMP and ICC from image and video files. A security vulnerability exists in MetadataExtractor version 2.1.0. An attacker can exploit this vulnerability to cause a denial of service stack consumption...

PT-2019-11555 · Matthew Mccormick +4 · Jhead +4

Name of the Vulnerable Software and Affected Versions: jhead version 3.03 Description: The issue is related to incorrect access control, which can lead to a denial of service. This occurs when the victim opens a specially crafted JPEG file, affecting the iptc.c component, specifically the show IP...

Exiv2 Buffer Overflow Vulnerability (CNVD-2019-34614)

Exiv2 is a set of C++ libraries and command line applications for managing image metadata by Andreas Huggel programmers. The product provides the ability to read and write image metadata in a variety of formats including EXIF, IPTC and XMP. A buffer overflow vulnerability exists in Exiv2. An...

PT-2019-6321 · Exiv2 +2 · Exiv2 +2

Name of the Vulnerable Software and Affected Versions: Exiv2 versions through 0.27.2 Description: The issue is related to an out-of-bounds read in the mrwimage.cpp component of the Exiv2 library, which manages media file metadata. This could allow a remote attacker to cause a denial of service...

Exiv2 Code Issue Vulnerability

Exiv2 is a set of C++ libraries and command line applications for managing image metadata by Andreas Huggel programmers. The product provides the ability to read and write image metadata in a variety of formats including EXIF, IPTC and XMP. A code issue vulnerability exists in Exiv2. An attacker...