Most recent entries from all

bdu:2025-13813

EUVD-2026-251410

fkie_cve-2025-55304

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.

GHSA-m54q-mm9w-fp6g — Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

Affected: PyPI: Exiv2

### Impact A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in `jpegBase::readMetadata()` can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.

### Patches The bug is fixed in version v0.28.6.

### References Issue: https://github.com/Exiv2/exiv2/issues/3333 Fixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)

### For more information Please see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.

OESA-2025-2116 — exiv2 security update

Affected: openEuler:24.03-LTS-SP1: exiv2

Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats. Security Fix(es):

A vulnerability, which was classified as problematic, was found in exiv2 up to 0.28.5 (Image Processing Software).CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying the patch e737332427711f15bcdc4e903203d6b7493eaec0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-54080)

A vulnerability was found in exiv2 up to 0.28.5 (Image Processing Software). It has been classified as problematic.CWE is classifying the issue as CWE-407. An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.This is going to have an impact on availability.Upgrading to version 0.28.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation i…

openSUSE-SU-2026:10298-1 — exiv2-0.28.8-1.1 on GA media

exiv2-0.28.8-1.1 on GA media

PYSEC-2026-1355 — Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

Affected: PyPI: exiv2

### Patches The bug is fixed in version v0.28.6.

### References Issue: https://github.com/Exiv2/exiv2/issues/3333 Fixes: https://github.com/Exiv2/exiv2/pull/3335 (main branch), https://github.com/Exiv2/exiv2/pull/3345 (0.28.x branch)

### For more information Please see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.

SUSE-SU-2026:20923-1 — Security update for exiv2

Security update for exiv2

UBUNTU-CVE-2025-55304

Affected: Ubuntu:Pro:20.04:LTS: exiv2, Ubuntu:22.04:LTS: exiv2, Ubuntu:24.04:LTS: exiv2, Ubuntu:25.10: exiv2