3215 matches found
exiv2 -- Use after free in TiffSubIfd
Kevin Backhouse reports: A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4. Versions prior to v0.28.0, such as v0.27.7, are not affected. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The heap overflo...
Exiv2 资源管理错误漏洞
Exiv2 is a suite of C++ libraries and command line applications for managing image metadata from the individual developer Andreas Huggel. The product provides the ability to read and write image metadata in a variety of formats including EXIF, IPTC and XMP. A resource management error vulnerabili...
CVE-2025-26623: Use After Free
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4. Versions prior to v0.28.0, such as v0.27.7, are not affected. Exiv2 is a command-line utility and C++...
PT-2025-7218
Name of the Vulnerable Software and Affected Versions: Exiv2 versions v0.28.0 through v0.28.4 Description: A heap buffer overflow was found in Exiv2 when used to write metadata into a crafted image file. This issue can be exploited by an attacker to gain code execution if they can trick the victi...
ROS-20250117-01
Exiv2 media metadata management library vulnerability is related to the use of an uninitialized resource. of an uninitialized resource. Exploitation of the vulnerability could allow an attacker to gain unauthorized access to protected information...
The vulnerability of the Exiv2 metadata management library, related to reading data outside of the allowed range in memory, allows a hacker to cause a service failure.
The vulnerability of the Exiv2 metadata management library relates to reading data outside the allowed range in memory when metadata is written to the created image file. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2007-6353 affecting package exiv2 0.28.0-1
CVE-2007-6353 affecting package exiv2 0.28.0-1. This CVE either no longer is or was never applicable...
ROS-20250110-02
A vulnerability in the Exiv2 media metadata management library is related to a flaw in the use of the assert function. Exploitation of the vulnerability allows an attacker acting remotely to cause a denial of service using a specially crafted image file Vulnerability in the Jp2Image::readMetadata...
Medium: exiv2
Issue Overview: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, QuickTimeVideo::NikonTagsDecoder, was new in v0.28.0, so Exiv2 versions...
Medium: exiv2
Issue Overview: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, QuickTimeVideo::NikonTagsDecoder, was new in v0.28.0, so Exiv2 versions...
Amazon Linux 2 : exiv2 (ALAS-2025-2728)
The version of exiv2 installed on the remote host is prior to 0.27.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2728 advisory. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. ...
CVE-2024-39695
A flaw was found in the Exiv2 library. An out-of-bounds read can be triggered when the metadata of a specially crafted ASF video file is processed, causing the application linked to the library to crash, resulting in a denial of service...
GHSA-CRMJ-QH74-2R36 Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder
Impact A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function, QuickTimeVideo::multipleEntriesDecoder, was new in v0.28.0 see https://github.com/Exiv2/exiv2/pull/2337, so Exiv2 versions before v0.28...
Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder
Impact A denial-of-service was found in Exiv2 version v0.28.1: an unbounded recursion can cause Exiv2 to crash by exhausting the stack. The vulnerable function, QuickTimeVideo::multipleEntriesDecoder, was new in v0.28.0 see https://github.com/Exiv2/exiv2/pull/2337, so Exiv2 versions before v0.28...
GHSA-G9XM-7538-MQ8W Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder
Impact An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, QuickTimeVideo::NikonTagsDecoder, was new in v0.28.0 see https://github.com/Exiv2/exiv2/pull/2337, so Exiv2 versions before v0.28 are not affected. Exiv2 is a command-line utility and C++ library for reading...
Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder
Impact An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, QuickTimeVideo::NikonTagsDecoder, was new in v0.28.0 see https://github.com/Exiv2/exiv2/pull/2337, so Exiv2 versions before v0.28 are not affected. Exiv2 is a command-line utility and C++ library for reading...
CentOS 7 : compat-exiv2-023 (RHSA-2021:3234)
The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3234 advisory. - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a duplicate of CVE-2021-29457. Notes: All CVE users...
Buffer underflow in base64decode
With the following new fuzz target generated by https://github.com/google/oss-fuzz-gen: include include include include "utils.hpp" include // File under test include // Auxiliary headers include include include include include include if hasinclude include namespace fs = std::filesystem; else...
exiv2: buffer-overflow in Exiv2::Uri::Parse
With the following new fuzz target generated by https://github.com/google/oss-fuzz-gen: include include include include include // Include standard library headers before project-specific headers include "/usr/include/expat.h" include extern "C" int LLVMFuzzerTestOneInputconst uint8t data, sizet...