Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, BmffImage::brotliUncompress, is new in v0.28.0, so earlier versions of Exiv2 are not affected. The out-of-bounds write is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. This bug is fixed in version v0.28.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be triggered by a crafted file. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input.
Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file.
There is a heap-based buffer over-read in the Image::printIFDStructure function in image.cpp in Exiv2 0.26. A Crafted input will lead to a remote denial of service attack.
There is a Segmentation fault in the XmpParser::terminate() function in Exiv2 0.26, related to an exit call. A Crafted input will lead to a remote denial of service attack.
There is a heap-based buffer overflow in the Image::printIFDStructure function of image.cpp in Exiv2 0.26. A Crafted input will lead to a remote denial of service attack.
There is a heap-based buffer overflow in basicio.cpp of Exiv2 0.26. The vulnerability causes an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact.
There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.26. A crafted input will lead to a remote denial of service attack.
A flaw was found in Exiv2 0.26. The samples/geotag.cpp in the example code misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possibly leading to a buffer overflow.
References: https://github.com/Exiv2/exiv2/issues/382
There is a heap-based buffer over-read in libexiv2 in Exiv2 0.26 that is triggered in the Exiv2::Image::io function in image.cpp. It will lead to remote denial of service.
Exiv2 0.26 contains a heap buffer overflow in tiff parser
There is an invalid free in the Action::TaskFactory::cleanup function of actions.cpp in Exiv2 0.26. A crafted input will lead to a remote denial of service attack.
Exiv2 0.16 allows user-assisted remote attackers to cause a denial of service (divide-by-zero and application crash) via a zero value in Nikon lens information in the metadata of an image, related to "pretty printing" and the RationalValue::toLong function.
exiv2 0.26 contains a Stack out of bounds read in webp parser
There is an illegal address access in the extendaliastable function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service.
There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input.
There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a denial of service attack.
Upstream issue:
https://github.com/Exiv2/exiv2/issues/590
References:
https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a denial of service attack.
Upstream issue:
https://github.com/Exiv2/exiv2/issues/590
References:
https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a denial of service attack.
Upstream issue:
https://github.com/Exiv2/exiv2/issues/590
References:
https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
An issue was found in Exiv2 v0.27-RC2. A NULL pointer dereference in Exiv2::isoSpeed in easyaccess.cpp allows remote attackers to cause a denial of service via a crafted file.
References: https://github.com/Exiv2/exiv2/issues/561
A flaw was found in Exiv2 0.27-RC1. An infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp. A crafted input will lead to a remote denial of service attack.
References: https://github.com/Exiv2/exiv2/issues/511
Upstream Patch: https://github.com/Exiv2/exiv2/pull/517
A flaw was found in Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.
References: https://github.com/Exiv2/exiv2/issues/455
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
A flaw was found in Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.
References: https://github.com/Exiv2/exiv2/issues/453
A flaw was found in Exiv2 0.26. A heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.
References: https://github.com/Exiv2/exiv2/issues/378
Upstream patch: https://github.com/Exiv2/exiv2/commit/505e2417e408abaf8f9fe9e5076f567a65cc59c3
A flaw was found in Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file.
References: https://github.com/Exiv2/exiv2/issues/307
Exiv2 through version 0.26 is vulnerable to a segmentation fault in the pngimage.cpp:tEXtToDataBuf() function. An attacker could exploit this to cause a denial of service or via crafted file.
Product Bug:
https://bugzilla.redhat.com/showbug.cgi?id=1566260
Exiv2::Image::byteSwap2 in image.cpp in Exiv2 0.26 has a heap-based buffer over-read.