Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-exiv2amazon-linux-ami-2-upgrade-exiv2-debuginfoamazon-linux-ami-2-upgrade-exiv2-develamazon-linux-ami-2-upgrade-exiv2-docamazon-linux-ami-2-upgrade-exiv2-libs | Apr 27, 2020 | Jun 13, 2018 | |
| Centos_linux | — | centos-upgrade-exiv2centos-upgrade-exiv2-debuginfocentos-upgrade-exiv2-develcentos-upgrade-exiv2-doccentos-upgrade-exiv2-libs | Aug 28, 2019 | Jun 13, 2018 |
| Debian | debian-upgrade-exiv2 | Jul 7, 2018 | Jun 13, 2018 | |
| Gentoo Linux | gentoo-linux-upgrade-media-gfx-exiv2 | Nov 26, 2018 | Jun 13, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-exiv2-libs | Sep 27, 2018 | Jun 13, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-exiv2-libs | Sep 27, 2018 | Jun 13, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-exiv2oracle-linux-upgrade-exiv2-develoracle-linux-upgrade-exiv2-docoracle-linux-upgrade-exiv2-libs | Jul 21, 2020 | Jun 11, 2018 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-exiv2redhat-upgrade-exiv2-debuginforedhat-upgrade-exiv2-develredhat-upgrade-exiv2-docredhat-upgrade-exiv2-libs | Aug 7, 2019 | Jun 13, 2018 | |
| Suse | — | suse-upgrade-exiv2suse-upgrade-exiv2-langsuse-upgrade-libexiv2-26suse-upgrade-libexiv2-26-32bitsuse-upgrade-libexiv2-develsuse-upgrade-libexiv2-doc | Oct 24, 2018 | Jun 13, 2018 |
| Ubuntu | ubuntu-upgrade-exiv2ubuntu-upgrade-libexiv2-12ubuntu-upgrade-libexiv2-14 | Jul 10, 2018 | Jun 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub