Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Security update for exiv2 prevents crashes and data corruption
published 4 months ago
Summary
This update fixes security issues in exiv2 that could cause the program to crash or behave unexpectedly. It's essential to install this update to ensure the stability and security of your system. You can install the update by running the latest version of exiv2.
What to do
- Update suse exiv2 to version 0.27.5-150400.15.7.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | suse | exiv2 |
< 0.27.5-150400.15.7.1 Fix: upgrade to 0.27.5-150400.15.7.1
|
Original advisory text
Security update for exiv2
This update for exiv2 fixes the following issues
- CVE-2021-34334: DoS due to integer overflow in loop counter (bsc#1189338).
- CVE-2026-25884: out-of-bounds read in `CrwMap: decode0x0805` (bsc#1259083).
- CVE-2026-27596: integer overflow in `LoaderNative: getData()` leads to out-of-bounds read (bsc#1259084).
- CVE-2026-27631: crash due to uncaught exception when trying to create `std: vector` larger than `max_size()`
(bsc#1259085).
Changes for exiv2:
* Minor bugs and fixes
- Other improvements
* exivsimple has array index errors when stripping quotes form
TIFF parser,Binary array elements should be decoded using the
Add option -K Key (--key Key) to specify one or more keys to
'exiv2 -eX' followed by 'exiv2 -iX' produces invalid XMP
- This release introduces support for Postscript (EPS) images.
XMP metadata can be read and written from/to EPS images and
previews are accessible.
Further it includes a new build environment for MSVC 64 bit
- fix build with gcc 4.3 (upstream backport)
* Fix 'Since v0.14 the version check macro doesn't work in a precompiler
- CVE-2021-34334: DoS due to integer overflow in loop counter (bsc#1189338).
- CVE-2026-25884: out-of-bounds read in `CrwMap: decode0x0805` (bsc#1259083).
- CVE-2026-27596: integer overflow in `LoaderNative: getData()` leads to out-of-bounds read (bsc#1259084).
- CVE-2026-27631: crash due to uncaught exception when trying to create `std: vector` larger than `max_size()`
(bsc#1259085).
Changes for exiv2:
* Minor bugs and fixes
- Other improvements
* exivsimple has array index errors when stripping quotes form
TIFF parser,Binary array elements should be decoded using the
Add option -K Key (--key Key) to specify one or more keys to
'exiv2 -eX' followed by 'exiv2 -iX' produces invalid XMP
- This release introduces support for Postscript (EPS) images.
XMP metadata can be read and written from/to EPS images and
previews are accessible.
Further it includes a new build environment for MSVC 64 bit
- fix build with gcc 4.3 (upstream backport)
* Fix 'Since v0.14 the version check macro doesn't work in a precompiler
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20262584-1/ Vendor Advisory
- https://bugzilla.suse.com/1189338 Third Party Advisory
- https://bugzilla.suse.com/1259083 Third Party Advisory
- https://bugzilla.suse.com/1259084 Third Party Advisory
- https://bugzilla.suse.com/1259085 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2021-34334 URL
- https://www.suse.com/security/cve/CVE-2026-25884 URL
- https://www.suse.com/security/cve/CVE-2026-27596 URL
- https://www.suse.com/security/cve/CVE-2026-27631 URL
Timeline
Published23 Jun 2026
Updated24 Jun 2026
First seen24 Jun 2026
Sources
SUSE-SU-2026:2584-1 · OSV
Track software like this
Free during beta