Exiv2 vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-44398 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata.High 8.8 · Nov 6, 2023
• CVE-2020-18831 Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecifiHigh 7.8 · Aug 22, 2023
• CVE-2020-18771 Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak.High 8.1 · Aug 23, 2021
• CVE-2021-31292 An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via craHigh 7.5 · Jul 26, 2021
• CVE-2021-29457 Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files.High 7.8 · Apr 19, 2021
• CVE-2019-20421 In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption.High 7.5 · Jan 27, 2020
• CVE-2019-14368 Exiv2 0.27.99.0 has a heap-based buffer over-read in Exiv2::RafImage::readMetadata() in rafimage.cpp.High 7.8 · Jul 28, 2019
• CVE-2019-9144 An issue was discovered in Exiv2 0.27.High 8.8 · Feb 25, 2019
• CVE-2019-9143 An issue was discovered in Exiv2 0.27.High 8.8 · Feb 25, 2019
• CVE-2018-14338 samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used, possHigh 8.1 · Jul 17, 2018
• CVE-2018-14046 Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp.High 8.8 · Jul 13, 2018
• CVE-2018-12265 Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.High 8.8 · Jun 13, 2018
• CVE-2018-12264 Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp.High 8.8 · Jun 13, 2018
• CVE-2018-11531 Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.Critical 9.8 · May 29, 2018
• CVE-2018-9305 In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0x1c" case.High 8.1 · Apr 4, 2018
• CVE-2018-9144 In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp.High 8.1 · Mar 30, 2018
• CVE-2017-17723 In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp.High 8.1 · Feb 12, 2018
• CVE-2017-12955 There is a heap-based buffer overflow in basicio.cpp of Exiv2 0.26.High 8.8 · Aug 18, 2017
• CVE-2017-11592 There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service atHigh 7.5 · Jul 23, 2017
• CVE-2017-11591 There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input.High 7.5 · Jul 23, 2017
• CVE-2017-11553 There is an illegal address access in the extend_alias_table function in localealias.c of Exiv2 0.26.High 7.5 · Jul 22, 2017
• CVE-2017-9953 There is an invalid free in Image::printIFDStructure that leads to a Segmentation fault in Exiv2 0.26.High 7.5 · Jun 26, 2017
• CVE-2007-6353 Integer overflow in exif.cpp in exiv2 library allows context-dependent attackers to execute arbitrary code via a crafted EXIF file that triggers a heap-based buHigh 7.5 · Dec 19, 2007