Security
Security
Multiple vulnerabilities have been found in Exiv2, the worst of which can lead to a crash via Denial of Service.
| Package | media-gfx/exiv2 on all architectures |
|---|---|
| Affected versions | < 0.28.8 |
| Unaffected versions | >= 0.28.8 |
Exiv2 is a C++ library and set of tools for parsing, editing and saving Exif and IPTC metadata from images.
The following vulnerabilities have been discovered in Exiv2: 2 out of bounds reads, an integer overflow, and an uncaught exception. The worst of which can lead to a Denial of Service via a crash of the program. Please review the CVE identifiers referenced below for details.
The following is a possible outcome: data leakage via an out-of-bounds read or a Denial of Service via a crash of the program.
Avoid using the CLI tool, exiv2, with untrusted files.
All Exiv2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.28.8"