Skip to content
OpenAdvisories
Medium RHSA-2019:2101 25 CVEs

Red Hat Security Advisory: exiv2 security, bug fix, and enhancement update

Published Sep 16, 2024 · Updated Jun 27, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client exiv2 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::client exiv2-debuginfo 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::client exiv2-devel 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::client exiv2-doc 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::client exiv2-libs 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::computenode exiv2 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::computenode exiv2-debuginfo 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::computenode exiv2-devel 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::computenode exiv2-doc 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::computenode exiv2-libs 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::server exiv2 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::server exiv2-debuginfo 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::server exiv2-devel 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::server exiv2-doc 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::server exiv2-libs 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::workstation exiv2 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::workstation exiv2-debuginfo 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::workstation exiv2-devel 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::workstation exiv2-doc 0:0.27.0-2.el7_6
Red Hat · RHEL 7 enterprise_linux:7::workstation exiv2-libs 0:0.27.0-2.el7_6

Vulnerabilities 25

  • Medium 6.5
    CVE-2018-20096

    There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafte…

    exiv2 PyPI
  • Medium 6.5
    CVE-2018-20097

    There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A craft…

    exiv2 exiv2 Debian PyPI
  • Medium 6.5
    CVE-2018-20098

    There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted…

    exiv2 PyPI
  • Medium 6.5
    CVE-2018-20099

    There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will l…

    exiv2 PyPI
  • Unscored —
    CVE-2017-17724

    In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, rela…

  • Unscored —
    CVE-2018-10772

    The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (…

  • Unscored —
    CVE-2018-10958

    In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-10998

    An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of servic…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-10999

    An issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has a heap-based buffer ov…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-11037

    In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an informa…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-12264

    Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::Va…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-12265

    Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-14046

    Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.

  • Unscored —
    CVE-2018-17282

    An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.

  • Unscored —
    CVE-2018-17581

    CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive fun…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-18915

    There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted inp…

  • Unscored —
    CVE-2018-19107

    In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-19108

    In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of servic…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-19535

    In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (applic…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-19607

    Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer…

  • Unscored —
    CVE-2018-4868

    The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of s…

  • Unscored —
    CVE-2018-8976

    In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringForm…

    exiv2 Debian
  • Unscored —
    CVE-2018-8977

    In Exiv2 0.26, the Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp allows remote attackers to cause a deni…

  • Unscored —
    CVE-2018-9305

    In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak,…

  • Unscored —
    CVE-2019-9143

    An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file imag…

    exiv2 Debian

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1465061
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1470729
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1470737
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1470913
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1470946
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1470950
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1471772
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1473888
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1473889
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1475123
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1475124
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1482295
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1482296
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1482423
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494443
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494467
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494776
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494778
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494780
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494781
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494782
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494786
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1494787
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1495043
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1524104
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1524107
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1524116
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1525055
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1537353
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1545237
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1561213
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1561217
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1566260
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1566735
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1578659
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1579481
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1579544