An issue was found in Exiv2 0.26 and previous versions. A heap-based buffer over-read in PngChunk::readRawProfile function in pngchunkint.cpp may cause a denial of service via a crafted PNG file.

References: https://github.com/Exiv2/exiv2/issues/428 https://github.com/Exiv2/exiv2/pull/430

Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a malformed TIFF file. The vulnerability causes a segmentation fault.

[UPSTREAM BUG] https://github.com/Exiv2/exiv2/issues/168

[UPSTREAM PATCH] https://github.com/Exiv2/exiv2/pull/199