Oracle Linux 8 : exiv2 (ELSA-2021-1758)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1758 advisory. 0.27.3-2 - Avoid duplicating Changelog file Resolves: bz1880984 0.27.3-1 - Update to 0.27.3 Resolves: bz1880984 Tenable has extracted the preceding description...

ALPINE-CVE-2019-20421

In Jp2Image::readMetadata in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file...

CVE-2019-17402

Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimageint.cpp, because there is no validation of the relationship of the total size to the offset and size...