Vulnerabilities > Exiv2 > Exiv2

DATE CVE VULNERABILITY TITLE RISK
2019-10-09 CVE-2019-17402 Classic Buffer Overflow vulnerability in multiple products
Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.
network
low complexity
exiv2 debian canonical CWE-120
6.5
2019-08-12 CVE-2019-14982 Integer Overflow or Wraparound vulnerability in Exiv2
In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp.
network
exiv2 CWE-190
4.3
2019-07-28 CVE-2019-14370 Out-of-bounds Read vulnerability in multiple products
In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp.
network
low complexity
exiv2 debian CWE-125
6.5
2019-07-28 CVE-2019-14369 Out-of-bounds Read vulnerability in multiple products
Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-based buffer over-read) via a crafted image file.
network
low complexity
exiv2 debian CWE-125
6.5
2019-07-28 CVE-2019-14368 Out-of-bounds Read vulnerability in Exiv2 0.27.99.0
Exiv2 0.27.99.0 has a heap-based buffer over-read in Exiv2::RafImage::readMetadata() in rafimage.cpp.
network
exiv2 CWE-125
6.8
2019-07-11 CVE-2019-13504 Out-of-bounds Read vulnerability in multiple products
There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2.
network
low complexity
exiv2 debian CWE-125
6.5
2019-06-30 CVE-2019-13114 NULL Pointer Dereference vulnerability in multiple products
http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character.
network
low complexity
exiv2 fedoraproject debian canonical CWE-476
6.5
2019-06-30 CVE-2019-13113 Reachable Assertion vulnerability in multiple products
Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file.
network
low complexity
exiv2 fedoraproject canonical CWE-617
6.5
2019-06-30 CVE-2019-13112 Allocation of Resources Without Limits or Throttling vulnerability in multiple products
A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_alloc exception) via a crafted PNG image file.
network
low complexity
exiv2 fedoraproject canonical debian CWE-770
6.5
2019-06-30 CVE-2019-13111 Integer Overflow or Wraparound vulnerability in multiple products
A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.
local
low complexity
exiv2 fedoraproject CWE-190
5.5