Skip to content
OpenAdvisories
Unscored USN-3700-1 6 CVEs

exiv2 vulnerabilities

Published Jul 3, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to cause a denial of service.
(CVE-2018-10958, CVE-2018-10998)

It was discovered that Exiv2 incorrectly handled certain PNG files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-10999)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to execute arbitrary code.
(CVE-2018-11531)

It was discovered that Exiv2 incorrectly handled certain files.
An attacker could possibly use this to access sensitive information.
(CVE-2018-12264, CVE-2018-12265)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS exiv2 0.23-1ubuntu2.1
Ubuntu · 16.04 LTS 16.04:LTS exiv2 0.25-2.1ubuntu16.04.2
Ubuntu · 18.04 LTS 18.04:LTS exiv2 0.25-3.1ubuntu0.18.04.1

Vulnerabilities 6

  • Unscored —
    CVE-2018-10958

    In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-10998

    An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of servic…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-10999

    An issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has a heap-based buffer ov…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-11531

    Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-12264

    Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::Va…

    exiv2 exiv2 Debian Ubuntu
  • Unscored —
    CVE-2018-12265

    Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv…

    exiv2 exiv2 Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2018-10958
  • report
    https://ubuntu.com/security/CVE-2018-10998
  • report
    https://ubuntu.com/security/CVE-2018-10999
  • report
    https://ubuntu.com/security/CVE-2018-11531
  • report
    https://ubuntu.com/security/CVE-2018-12264
  • report
    https://ubuntu.com/security/CVE-2018-12265