Most recent entries from all

ALSA-2021:1758 — Low: exiv2 security, bug fix, and enhancement update

Affected: AlmaLinux:8: exiv2-devel, AlmaLinux:8: exiv2-doc

The exiv2 packages provide a command line utility which can display and manipulate image metadata such as EXIF, LPTC, and JPEG comments.

The following packages have been upgraded to a later upstream version: exiv2 (0.27.3). (BZ#1880984)

Security Fix(es):

* exiv2: out-of-bounds read in CiffDirectory::readDirectory due to lack of size check (CVE-2019-17402)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2020-05759

CLEANSTART-2024-BZ69967 — Exiv2 0

Affected: CleanStart: exiv2

Security vulnerability affects the exiv2 package. Exiv2 0.

cnvd-2020-13547

EUVD-2026-58384

fkie_cve-2019-17402

Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.

GHSA-xhv3-q5hx-88ww

gsd-2019-17402

msrc_CVE-2019-17402 — Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::Ciff…

msrc_CVE-2019-17402

Withdrawn: PYSEC-2019-247

Withdrawn by the publisher.

Affected: PyPI: exiv2

RHSA-2020:4030 — Red Hat Security Advisory: exiv2 security update

exiv2: out-of-bounds read in CiffDirectory::readDirectory due to lack of size check

SUSE-SU-2020:0860-1 — Security update for exiv2

Security update for exiv2

UBUNTU-CVE-2019-17402

Affected: Ubuntu:16.04:LTS: exiv2, Ubuntu:18.04:LTS: exiv2

WID-SEC-W-2026-0012 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.