The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p C`). The bug is fixed in version v0.27.5.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade exiv2-develUpgrade exiv2-libsUpgrade exiv2Upgrade exiv2-docUpgrade compat-exiv2-026 | May 4, 2022 | Aug 9, 2021 |
| Alpine Linux | — | Upgrade exiv2 | Aug 22, 2024 | Aug 9, 2021 |
| Centos_linux | — | Upgrade exiv2-libs-debuginfoUpgrade compat-exiv2-026-debugsourceUpgrade exiv2-libsUpgrade exiv2-debuginfoUpgrade exiv2-debugsourceUpgrade exiv2Upgrade compat-exiv2-026-debuginfoUpgrade compat-exiv2-026 | Nov 10, 2021 | Aug 9, 2021 |
| Debian | — | Upgrade exiv2 | Jul 30, 2024 | Aug 9, 2021 |
| Gentoo Linux | — | Upgrade media-gfx/exiv2. | Dec 27, 2023 | Aug 9, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade exiv2-libsUpgrade exiv2 | Nov 2, 2021 | Aug 9, 2021 |
| Oracle_linux | — | Upgrade compat-exiv2-026 | Nov 17, 2021 | Aug 8, 2021 |
| Redhat_linux | — | Upgrade exiv2-develUpgrade exiv2-debugsourceNo solution existsUpgrade exiv2-libs-debuginfoUpgrade compat-exiv2-026-debugsourceUpgrade exiv2-libsUpgrade compat-exiv2-026Upgrade compat-exiv2-026-debuginfoUpgrade exiv2Upgrade exiv2-docUpgrade exiv2-debuginfo | Nov 10, 2021 | Aug 9, 2021 |
| Rocky_linux | — | Upgrade compat-exiv2-026-debuginfoUpgrade exiv2-develUpgrade exiv2-debugsourceUpgrade compat-exiv2-026Upgrade exiv2-libsUpgrade exiv2Upgrade exiv2-libs-debuginfoUpgrade exiv2-debuginfoUpgrade compat-exiv2-026-debugsource | Mar 12, 2024 | Aug 9, 2021 |
| Suse | — | Upgrade libexiv2-26Upgrade libexiv2-docUpgrade exiv2-langUpgrade libexiv2-develUpgrade exiv2Upgrade libexiv2-26-32bit | Oct 26, 2022 | Aug 9, 2021 |
| Ubuntu | — | Upgrade libexiv2-14 (Ubuntu Pro)Upgrade libexiv2-14Upgrade libexiv2-27 | Aug 18, 2021 | Aug 9, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub