EUVD-2025-25031

Malicious code in bioql PyPI...

Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder

Impact An out-of-bounds read was found in Exiv2 version v0.28.1. The vulnerable function, QuickTimeVideo::NikonTagsDecoder, was new in v0.28.0 see https://github.com/Exiv2/exiv2/pull/2337, so Exiv2 versions before v0.28 are not affected. Exiv2 is a command-line utility and C++ library for reading...

PT-2024-28633

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.28.0 through v0.28.2 Description An out-of-bounds read was found in the parser for the ASF video format, a new feature introduced in version v0.28.0. This issue is triggered when Exiv2 is used to read the metadata of a crafte...

GHSA-W877-JFW7-46RJ DeepJavaLibrary API absolute path traversal

Summary DeepJavaLibraryDJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers 0.27.0. Impacted versions: 0.1...

PT-2024-20754

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.28.0 through v0.28.1 Description Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A denial-of-service was found in Exiv2, caused by an unbounded...

Design/Logic Flaw

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, BmffImage::brotliUncompress, is new in v0.28.0, so earlier versions of Exiv2 are not...

CVE-2023-44398

Exiv2 (C++ library) has an out-of-bounds write in v0.28.0 in the Brotli uncompression path (BmffImage::brotliUncompress) triggered by crafted image metadata. Earlier versions are not affected. The issue could lead to code execution if a victim runs Exiv2 on a crafted file. A fix is available in v...