Skip to content
OpenAdvisories
Medium RLSA-2020:1577 29 CVEs

Moderate: exiv2 security, bug fix, and enhancement update

Published Apr 28, 2020 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

The exiv2 packages provide a command line utility which can display and manipulate image metadata such as EXIF, LPTC, and JPEG comments.

The following packages have been upgraded to a later upstream version: exiv2 (0.27.2). (BZ#1651917)

Security Fix(es):

* exiv2: infinite loop and hang in Jp2Image::readMetadata() in jp2image.cpp could lead to DoS (CVE-2019-20421)

* exiv2: null pointer dereference in the Exiv2::DataValue::toLong function in value.cpp (CVE-2017-18005)

* exiv2: Excessive memory allocation in Exiv2::Jp2Image::readMetadata function in jp2image.cpp (CVE-2018-4868)

* exiv2: assertion failure in BigTiffImage::readData in bigtiffimage.cpp (CVE-2018-9303)

* exiv2: divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp (CVE-2018-9304)

* exiv2: out of bounds read in IptcData::printStructure in iptc.c (CVE-2018-9305)

* exiv2: OOB read in pngimage.cpp:tEXtToDataBuf() allows for crash via crafted file (CVE-2018-10772)

* exiv2: information leak via a crafted file (CVE-2018-11037)

* exiv2: buffer overflow in samples/geotag.cpp (CVE-2018-14338)

* exiv2: heap-based buffer overflow in Exiv2::d2Data in types.cpp (CVE-2018-17229)

* exiv2: heap-based buffer overflow in Exiv2::ul2Data in types.cpp (CVE-2018-17230)

* exiv2: NULL pointer dereference in Exiv2::DataValue::copy in value.cpp leading to application crash (CVE-2018-17282)

* exiv2: Stack overflow in CiffDirectory::readDirectory() at crwimage_int.cpp leading to denial of service (CVE-2018-17581)

* exiv2: infinite loop in Exiv2::Image::printIFDStructure function in image.cpp (CVE-2018-18915)

* exiv2: heap-based buffer over-read in Exiv2::IptcParser::decode in iptc.cpp (CVE-2018-19107)

* exiv2: infinite loop in Exiv2::PsdImage::readMetadata in psdimage.cpp (CVE-2018-19108)

* exiv2: heap-based buffer over-read in PngChunk::readRawProfile in pngchunk_int.cpp (CVE-2018-19535)

* exiv2: NULL pointer dereference in Exiv2::isoSpeed in easyaccess.cpp (CVE-2018-19607)

* exiv2: Heap-based buffer over-read in Exiv2::tEXtToDataBuf function resulting in a denial of service (CVE-2018-20096)

* exiv2: Segmentation fault in Exiv2::Internal::TiffParserWorker::findPrimaryGroups function (CVE-2018-20097)

* exiv2: Heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header resulting in a denial of service (CVE-2018-20098)

* exiv2: Infinite loop in Exiv2::Jp2Image::encodeJp2Header resulting in a denial of service (CVE-2018-20099)

* exiv2: infinite recursion in Exiv2::Image::printTiffStructure in file image.cpp resulting in denial of service (CVE-2019-9143)

* exiv2: denial of service in PngImage::readMetadata (CVE-2019-13109)

* exiv2: integer overflow in WebPImage::decodeChunks leads to denial of service (CVE-2019-13111)

* exiv2: uncontrolled memory allocation in PngChunk::parseChunkContent causing denial of service (CVE-2019-13112)

* exiv2: invalid data location in CRW image file causing denial of service (CVE-2019-13113)

* exiv2: null-pointer dereference in http.c causing denial of service (CVE-2019-13114)

* exiv2: out of bounds read in IptcData::printStructure in iptc.c (CVE-2018-9306)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

Fixed packages 4

ReleasePackageFixed in
Rocky Linux · 8 exiv2 0:0.27.2-5.el8
Rocky Linux · 8 gegl 0:0.2.0-39.el8
Rocky Linux · 8 gnome-color-manager 0:3.28.0-3.el8
Rocky Linux · 8 libgexiv2 0:0.10.8-4.el8

Vulnerabilities 29

  • Medium 6.5
    CVE-2018-20096

    There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafte…

    exiv2 PyPI
  • Medium 6.5
    CVE-2018-20097

    There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A craft…

    exiv2 exiv2 Debian PyPI
  • Medium 6.5
    CVE-2018-20098

    There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted…

    exiv2 PyPI
  • Medium 6.5
    CVE-2018-20099

    There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will l…

    exiv2 PyPI
  • Medium 6.5
    CVE-2019-13114

    http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer…

    exiv2 exiv2 exiv2 exiv2 Debian Ubuntu Alpine PyPI
  • Unscored —
    CVE-2017-18005

    Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted met…

    exiv2 Debian
  • Unscored —
    CVE-2018-10772

    The tEXtToDataBuf function in pngimage.cpp in Exiv2 through 0.26 allows remote attackers to cause a denial of service (…

  • Unscored —
    CVE-2018-11037

    In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an informa…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-14338

    samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple…

    exiv2 Debian
  • Unscored —
    CVE-2018-17229 Public exploit

    Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overf…

  • Unscored —
    CVE-2018-17230

    Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over…

  • Unscored —
    CVE-2018-17282

    An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.

  • Unscored —
    CVE-2018-17581

    CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive fun…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-18915

    There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. A crafted inp…

  • Unscored —
    CVE-2018-19107

    In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-19108

    In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of servic…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-19535

    In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (applic…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-19607

    Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer…

  • Unscored —
    CVE-2018-4868

    The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of s…

  • Unscored —
    CVE-2018-9303

    In Exiv2 0.26, an assertion failure in BigTiffImage::readData in bigtiffimage.cpp results in an abort.

  • Unscored —
    CVE-2018-9304

    In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp could result in denial of service.

  • Unscored —
    CVE-2018-9305

    In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak,…

  • Unscored —
    CVE-2018-9306 Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-17724. Reason: This candidate is a reservation duplicate of CVE-…

  • Unscored —
    CVE-2019-13109

    An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG…

    exiv2 exiv2 Debian Alpine
  • Unscored —
    CVE-2019-13111

    A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (lar…

    exiv2 Alpine
  • Unscored —
    CVE-2019-13112

    A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a deni…

    exiv2 exiv2 exiv2 Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-13113

    Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid da…

    exiv2 exiv2 exiv2 Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-20421

    In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, wit…

    exiv2 exiv2 exiv2 exiv2 Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2019-9143

    An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file imag…

    exiv2 Debian

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1531171
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1531724
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1566725
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1566731
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1566735
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1566737
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1579544
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1594627
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1609396
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1632481
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1632484
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1632490
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1635045
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1646555
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1649094
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1649101
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1651917
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1656187
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1656195
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1660423
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1660424
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1660425
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1660426
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1684381
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1728484
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1728488
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1728490
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1728492
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1728494
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1757444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1757445
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1767748
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1800472