An issue was discovered in Exempi before 2.4.4. An integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file.
Reference: https://bugs.freedesktop.org/showbug.cgi?id=102151
Patch: https://cgit.freedesktop.org/exempi/commit/?id=65a8492832b7335ffabd01f5f64d89dec757c260
An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFFMemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFFSupport.hpp.
An issue was discovered in Exempi before 2.4.4. The ASFSupport::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASFSupport.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted .asf file.
An issue was discovered in Exempi before 2.4.4. The TradQTManager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTimeSupport.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .qt file.
An issue was discovered in Exempi through 2.4.4. A certain case of a 0xffffffff length is mishandled in XMPFiles/source/FormatSupport/PSIRFileWriter.cpp, leading to a heap-based buffer over-read in the PSDMetaHandler::CacheFileData() function.
An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FileHandlers/TIFFHandler.cpp mishandles a case of a zero length, leading to a heap-based buffer over-read in the MD5Update() function in third-party/zuid/interfaces/MD5.cpp.
An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FormatSupport/WEBPSupport.cpp does not check whether a bitstream has a NULL value, leading to a NULL pointer dereference in the WEBP::VP8XChunk class.
An issue was discovered in Exempi through 2.4.4. There is a stack-based buffer over-read in the PostScriptMetaHandler::ParsePSFile() function in XMPFiles/source/FileHandlers/PostScriptHandler.cpp.