K57108702: Apache Tika XML External Entity vulnerability CVE-2016-4434

Security Advisory Description Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity XXE attacks via vectors involving 1 spreadsheets in OOXML files and 2 XMP metadata in PDF and other file formats,...

SUSE CVE-2013-1980

Buffer overflow in the getdsmp function in loaders/masiload.c in libxmp before 4.1.0 allows remote attackers to execute arbitrary code via a crafted MASI file...

SUSE CVE-2016-5684

An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library. A specially crafted XMP file can cause an arbitrary memory overwrite resulting in code execution. An attacker can provide a malicious image to trigger this vulnerability...

SUSE CVE-2017-11340

There is a Segmentation fault in the XmpParser::terminate function in Exiv2 0.26, related to an exit call. A Crafted input will lead to a remote denial of service attack...

SUSE CVE-2017-18238

An issue was discovered in Exempi before 2.4.4. The TradQTManager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTimeSupport.cpp allows remote attackers to cause a denial of service infinite loop via crafted XMP data in a .qt file...

SUSE CVE-2021-29421

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries...

Mageia: Security Advisory (MGASA-2022-0236)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Exempi vulnerabilities (USN-5483-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5483-1 advisory. It was discovered that Exempi incorrectly handled certain media files. If a user or automated system were tricked into opening a...

Denial Of Service (DoS)

XMP Toolkit is vulnerable to denial of service. The vulnerability exists due to a null pointer dereference which allows an attacker to cause a memory corruption and there by an application crash...

Out-of-bounds Read

XMP Toolkit SDK versions 2021.07 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a vict...

Arbitrary Code Execution

XMP Toolkit is vulnerable to arbitrary code injection. The vulnerability exists due to a memory corruption when a victim opens a crafted file which allows an attacker to inject and execute malicious code...

Arbitrary Code Execution

XMP Toolkit version 2020.1 and earlier is affected by a Buffer Underflow vulnerability which could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Arbitrary Code Execution

XMP Toolkit is vulnerable to arbitrary code injection. The vulnerability exists due to a memory corruption vulnerability which allows an attacker to inject and execute malicious code...

Out-of-bounds Read

XMP Toolkit SDK versions 2020.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victi...

Arbitrary Code Execution

XMP Toolkit is vulnerable to arbitrary code injection. The vulnerability exists due to a memory corruption when a victim opens a crafted file which allows an attacker to inject and execute malicious code...

Arbitrary Code Execution

XMP Toolkit is vulnerable to arbitrary code execution. The vulnerability exists because of a memory corruption which allows an attacker to inject and execute arbitrary codes...

Improper Input Validation

XMP Toolkit SDK version 2020.1 and earlier is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file...

OESA-2022-1649 xmlgraphics-commons security update

Apache XML Graphics Commons is a library that consists of several reusable components used by Apache Batik and Apache FOP. Many of these components can easily be used separately outside the domains of SVG and XSL-FO. You will find components such as a PDF library, an RTF library, Graphics2D...

RLSA-2022:1842 Moderate: exiv2 security, bug fix, and enhancement update

Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats. The following packages have been upgraded to ...

Remote Code Execution (RCE)

XMP Toolkit SDK is vulnerable to remote code execution. A stack-based buffer overflow is causes which potentially results in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file...