exiv2 (PyPI)
Advisories
90
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.28.5 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "exiv2>=0.28.5"poetry
poetry add "exiv2>=0.28.5"uv
uv add "exiv2>=0.28.5"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-m54q-mm9w-fp6g Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata |
Medium EPSS 0.25% |
<= 0.17.3 | No fix yet |
| GHSA-m54q-mm9w-fp6g Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata |
Medium EPSS 0.25% |
<= 0.17.3 | No fix yet |
| GHSA-496f-x7cq-cq39 Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file |
Medium EPSS 0.14% |
<= 0.17.3 | No fix yet |
| GHSA-496f-x7cq-cq39 Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file |
Medium EPSS 0.14% |
<= 0.17.3 | No fix yet |
| GHSA-38h4-fx85-qcx7 Exiv2 allows Use After Free |
Critical EPSS 0.92% |
>= 0.28.0, < 0.28.5 | 0.28.5 |
| GHSA-38h4-fx85-qcx7 Exiv2 allows Use After Free |
Critical EPSS 0.92% |
>= 0.28.0, < 0.28.5 | 0.28.5 |
| GHSA-crmj-qh74-2r36 Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder |
Medium EPSS 0.22% |
>= 0.16.0, < 0.16.1 | 0.16.1 |
| GHSA-g9xm-7538-mq8w Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder |
Medium EPSS 0.24% |
>= 0.16.0, < 0.16.1 | 0.16.1 |
| GHSA-g9xm-7538-mq8w Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder |
Medium EPSS 0.24% |
>= 0.16.0, < 0.16.1 | 0.16.1 |
| GHSA-crmj-qh74-2r36 Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder |
Medium EPSS 0.22% |
>= 0.16.0, < 0.16.1 | 0.16.1 |
| PYSEC-2023-233 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. |
High EPSS 0.97% |
all versions | No fix yet |
| PYSEC-2023-150 Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other… |
High EPSS 0.80% |
all versions | No fix yet |
| PYSEC-2021-882 Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an information leak. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2021-884 A float point exception in the printLong function in tags_int.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via a crafted tif file. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2021-883 An invalid memory access in the decode function in iptc.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via a crafted tif file. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2021-879 An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a… |
Medium EPSS 1.66% |
all versions | No fix yet |
| PYSEC-2021-885 A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2021-877 An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via… |
High EPSS 2.56% |
all versions | No fix yet |
| PYSEC-2021-886 A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS). Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2020-344 In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2019-247 Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2019-245 Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-based buffer over-read) via a crafted… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2019-244 Exiv2 0.27.99.0 has a heap-based buffer over-read in Exiv2::RafImage::readMetadata() in rafimage.cpp. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2019-246 In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2019-257 http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted… |
Medium EPSS 2.12% |
No fix yet | |
| PYSEC-2019-248 An issue was discovered in Exiv2 0.27. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2019-249 An issue was discovered in Exiv2 0.27. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2018-118 There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. |
Medium EPSS 2.29% |
all versions | No fix yet |
| PYSEC-2018-119 There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. |
Medium EPSS 2.57% |
all versions | No fix yet |
| PYSEC-2018-120 There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. |
Medium EPSS 2.29% |
all versions | No fix yet |
| PYSEC-2018-117 There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. |
Medium EPSS 2.76% |
all versions | No fix yet |
| PYSEC-2018-143 Exiv2::isoSpeed in easyaccess.cpp in Exiv2 v0.27-RC2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-141 In Exiv2 0.26, Exiv2::IptcParser::decode in iptc.cpp (called from psdimage.cpp in the PSD image reader) may suffer from a denial of service (heap-based buffer… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-142 In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-140 There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.27-RC1. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-139 CiffDirectory::readDirectory() at crwimage_int.cpp in Exiv2 0.26 has excessive stack consumption due to a recursive function, leading to Denial of service. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-138 An issue was discovered in Exiv2 v0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-137 Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-136 Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-135 Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted image… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-134 samples/geotag.cpp in the example code of Exiv2 0.26 misuses the realpath function on POSIX platforms (other than Apple platforms) where glibc is not used,… Withdrawn |
High | all versions | No fix yet |
| PYSEC-2018-133 Exiv2 0.26 has a heap-based buffer over-read in WebPImage::decodeChunks in webpimage.cpp. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2018-132 Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2018-131 Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2018-130 Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. Withdrawn |
Critical | all versions | No fix yet |
| PYSEC-2018-129 In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-127 An issue was discovered in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-128 An issue was discovered in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-126 In types.cpp in Exiv2 0.26, a large size value may lead to a SIGABRT during an attempt at memory allocation for an Exiv2::Internal::PngChunk::zlibUncompress… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-125 Exiv2::Image::byteSwap2 in image.cpp in Exiv2 0.26 has a heap-based buffer over-read. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-148 In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-147 In Exiv2 0.26, the Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp allows remote attackers to cause a denial of service (invalid memory access)… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-146 In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-122 In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2018-123 In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" case. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-124 In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-121 In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-145 In Exiv2 0.26, there is a segmentation fault caused by uncontrolled recursion in the Exiv2::Image::printIFDStructure function in the image.cpp file. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2018-144 The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive memory allocation) via… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-141 Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-140 There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-115 exiv2 0.26 contains a Stack out of bounds read in webp parser Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-117 Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-116 Exiv2 0.26 contains a heap buffer overflow in tiff parser Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-131 There is a heap-based buffer overflow in the Exiv2::l2Data function of types.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-137 An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-138 There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-139 There is a heap-based buffer overflow in the Exiv2::s2Data function of types.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-136 A NULL pointer dereference was discovered in Exiv2::Image::printIFDStructure in image.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-135 An Invalid memory address dereference was discovered in Exiv2::DataValue::read in value.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-134 There is a stack consumption vulnerability in the Exiv2::Internal::stringFormat function of image.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-133 There is a heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function of jp2image.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-130 In Exiv2 0.26, there is an invalid free in the Image class in image.cpp that leads to a Segmentation fault. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-132 An Invalid memory address dereference was discovered in Exiv2::StringValueBase::read in value.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-128 There is an illegal address access in Exiv2::FileIo::path[abi:cxx11]() in basicio.cpp of libexiv2 in Exiv2 0.26 that will lead to remote denial of service. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-129 There is a heap-based buffer over-read in libexiv2 in Exiv2 0.26 that is triggered in the Exiv2::Image::io function in image.cpp. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-127 There is a heap-based buffer overflow in basicio.cpp of Exiv2 0.26. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2017-126 There is a reachable assertion in the Internal::TiffReader::visitDirectory function in tiffvisitor.cpp of Exiv2 0.26 that will lead to a remote denial of… Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-124 There is a Floating point exception in the Exiv2::ValueType function in Exiv2 0.26 that will lead to a remote denial of service attack via crafted input. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2017-125 There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service… Withdrawn |
High | all versions | No fix yet |
| PYSEC-2017-123 There is an illegal address access in the extend_alias_table function in localealias.c of Exiv2 0.26. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2017-120 There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-121 There is a heap-based buffer overflow in the Image::printIFDStructure function of image.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-122 There is a Segmentation fault in the XmpParser::terminate() function in Exiv2 0.26, related to an exit call. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-119 There is an invalid free in the Action::TaskFactory::cleanup function of actions.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-118 There is a heap-based buffer over-read in the Image::printIFDStructure function in image.cpp in Exiv2 0.26. Withdrawn |
Medium | all versions | No fix yet |
| PYSEC-2017-142 There is an invalid free in Image::printIFDStructure that leads to a Segmentation fault in Exiv2 0.26. Withdrawn |
High | all versions | No fix yet |
| PYSEC-2017-112 An issue was discovered in Exiv2 0.26. |
Medium EPSS 2.63% |
all versions | No fix yet |
| PYSEC-2015-36 Buffer overflow in the RiffVideo::infoTagsHandler function in riffvideo.cpp in Exiv2 0.24 allows remote attackers to cause a denial of service (crash) via a… Withdrawn |
Not rated yet | all versions | No fix yet |
| PYSEC-2008-11 Exiv2 0.16 allows user-assisted remote attackers to cause a denial of service (divide-by-zero and application crash) via a zero value in Nikon lens information… Withdrawn |
Not rated yet | all versions | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor