{"id":"CVE-2019-17402","aliases":["ALPINE-CVE-2019-17402","ALSA-2021:1758","AZL-7204","DEBIAN-CVE-2019-17402","DLA-2019-1","DLA-3265-1","EUVD-2019-0052","GHSA-xhv3-q5hx-88ww","MGASA-2019-0415","PYSEC-2019-247","RHSA-2020:4030","RHSA-2021:1758","RLSA-2021:1758","SUSE-SU-2020:0860-1","SUSE-SU-2022:4208-1","SUSE-SU-2022:4276-1","UBUNTU-CVE-2019-17402","USN-4159-1"],"status":"published","title":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from...","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01851,"percentile":0.79277,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2019-10-09T00:00:00Z","modified":"2026-11-03T06:30:09Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"exiv2","fixed_in":["0.26-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"exiv2","fixed_in":["0.27.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"exiv2","fixed_in":["0.26-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"exiv2","fixed_in":["0.26-r1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"exiv2-devel","fixed_in":["0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"exiv2-doc","fixed_in":["0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"exiv2","fixed_in":["0.27.5-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"exiv2","fixed_in":["0.27.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exiv2","fixed_in":["0.27.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exiv2","fixed_in":["0.27.3-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"exiv2","fixed_in":["0.24-4.1+deb8u5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-debuginfo","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-libs","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-devel","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-doc","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-debuginfo","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-libs","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-devel","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-doc","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-debuginfo","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-libs","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-devel","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-doc","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-debuginfo","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-libs","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-devel","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-doc","fixed_in":["0:0.27.0-3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2-debuginfo","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2-debugsource","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2-libs","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2-libs-debuginfo","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-debuginfo","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-debugsource","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-devel","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-doc","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-libs-debuginfo","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"exiv2","fixed_in":["0:0.27.3-2.el8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"exiv2","fixed_in":["0.25-2.1ubuntu16.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"exiv2","fixed_in":["0.25-3.1ubuntu0.18.04.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24-4.1+deb8u5"}]}],"versions":["0.24-4.1","0.24-4.1+deb8u1","0.24-4.1+deb8u2","0.24-4.1+deb8u3","0.24-4.1+deb8u4"]},{"source":"osv","ecosystem":"Debian:10","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-4+deb10u4"}]}],"versions":["0.25-4","0.25-4+deb10u1","0.25-4+deb10u2","0.25-4+deb10u3"],"bundled":26},{"source":"osv","ecosystem":"Mageia:7","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.1-3.2.mga7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.0-3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"exiv2-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"exiv2-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.27.3-2.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-12.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-12.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-12.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-12.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-12.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23-12.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"exiv2-0_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150400.9.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"exiv2-0_26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150400.9.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26-150000.6.26.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-2.1ubuntu16.04.5"}]}],"versions":["0.25-1ubuntu1","0.25-2.1","0.25-2.1ubuntu16.04.1","0.25-2.1ubuntu16.04.2","0.25-2.1ubuntu16.04.3","0.25-2.1ubuntu16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.1ubuntu0.18.04.4"}]}],"versions":["0.25-3.1","0.25-3.1ubuntu0.18.04.1","0.25-3.1ubuntu0.18.04.2","0.25-3.1ubuntu0.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-2.1ubuntu16.04.5"}]}],"versions":["0.25-1ubuntu1","0.25-2.1","0.25-2.1ubuntu16.04.1","0.25-2.1ubuntu16.04.2","0.25-2.1ubuntu16.04.3","0.25-2.1ubuntu16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"exiv2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.1ubuntu0.18.04.4"}]}],"versions":["0.25-3.1","0.25-3.1ubuntu0.18.04.1","0.25-3.1ubuntu0.18.04.2","0.25-3.1ubuntu0.18.04.3"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"exiv2","product":"exiv2"}],"references":[{"url":"https://github.com/Exiv2/exiv2/issues/1019","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://usn.ubuntu.com/4159-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/12/msg00001.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17402","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xhv3-q5hx-88ww"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-17402","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-17402","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17402","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0415.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25280","tags":["report"]},{"url":"https://usn.ubuntu.com/4056-1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4030","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1773683","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4030.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17402","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17402","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1758","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1880984","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1758.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1758","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200860-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1040973","tags":["report"]},{"url":"https://bugzilla.suse.com/1110282","tags":["report"]},{"url":"https://bugzilla.suse.com/1142678","tags":["report"]},{"url":"https://bugzilla.suse.com/1142683","tags":["report"]},{"url":"https://bugzilla.suse.com/1153577","tags":["report"]},{"url":"https://bugzilla.suse.com/1161901","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20421","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224208-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1050257","tags":["report"]},{"url":"https://bugzilla.suse.com/1095070","tags":["report"]},{"url":"https://bugzilla.suse.com/1119559","tags":["report"]},{"url":"https://bugzilla.suse.com/1119560","tags":["report"]},{"url":"https://bugzilla.suse.com/1119562","tags":["report"]},{"url":"https://bugzilla.suse.com/1142677","tags":["report"]},{"url":"https://bugzilla.suse.com/1186231","tags":["report"]},{"url":"https://bugzilla.suse.com/1189337","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32815","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224276-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-17402","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4159-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-17402","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"published","published":"2019-10-09T00:00:00Z","modified":"2024-08-05T01:40:15.736Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-0052","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"published","published":"2019-10-09T00:00:00Z","modified":"2024-08-05T01:40:15Z","updated_at":"2026-11-03T02:40:30.328063Z"}],"ghsa":[{"id":"GHSA-xhv3-q5hx-88ww","title":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from...","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"published","published":"2022-05-24T16:58:20Z","modified":"2023-02-03T05:01:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:52:59.355645Z"}],"nvd":[{"id":"CVE-2019-17402","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"published","published":"2019-10-09T19:15:14.337Z","modified":"2026-06-17T02:23:53.843Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:05:31.019577Z"}],"osv":[{"id":"ALPINE-CVE-2019-17402","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"published","published":"2019-10-09T19:15:14.337Z","modified":"2026-11-03T06:30:09.639305843Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T06:41:39.834803Z"},{"id":"AZL-7204","title":"CVE-2019-17402 affecting package exiv2 for versions less than 0.27.5-1","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"published","published":"2019-10-09T19:15:14Z","modified":"2026-04-21T04:36:41.32451Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2019-17402","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"published","published":"2019-10-09T19:15:14.337Z","modified":"2026-10-20T10:50:48.700765067Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17402","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"published","published":"2019-10-09T19:15:14.337Z","modified":"2026-09-21T07:02:29.195387329Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"PYSEC-2019-247","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"withdrawn","published":"2019-10-09T19:15:00Z","modified":"2025-10-09T07:05:08.786493Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"RHSA-2020:4030","title":"Red Hat Security Advisory: exiv2 security update","status":"published","published":"2024-09-16T04:18:59Z","modified":"2026-06-26T12:22:08.890083769Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:1758","title":"Red Hat Security Advisory: exiv2 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T04:19:07Z","modified":"2026-06-26T12:21:15.831567646Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:1758","title":"Low: exiv2 security, bug fix, and enhancement update","description":"The exiv2 packages provide a command line utility which can display and manipulate image metadata such as EXIF, LPTC, and JPEG comments.\n\nThe following packages have been upgraded to a later upstream version: exiv2 (0.27.3). (BZ#1880984)\n\nSecurity Fix(es):\n\n* exiv2: out-of-bounds read in CiffDirectory::readDirectory due to lack of size check (CVE-2019-17402)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T06:01:36Z","modified":"2026-02-05T06:15:05.697756Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-17402","description":"Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the relationship of the total size to the offset and size.","status":"published","published":"2019-10-09T19:15:00Z","modified":"2026-04-22T12:13:58.68001Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"ALSA-2021:1758","title":"Low: exiv2 security, bug fix, and enhancement update","description":"The exiv2 packages provide a command line utility which can display and manipulate image metadata such as EXIF, LPTC, and JPEG comments.\n\nThe following packages have been upgraded to a later upstream version: exiv2 (0.27.3). (BZ#1880984)\n\nSecurity Fix(es):\n\n* exiv2: out-of-bounds read in CiffDirectory::readDirectory due to lack of size check (CVE-2019-17402)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-05-18T06:01:36Z","modified":"2026-10-29T11:00:42.64061952Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2019-1","title":"exiv2 - security update","status":"published","published":"2019-12-02T00:00:00Z","modified":"2026-03-09T01:22:22.824865Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-3265-1","title":"exiv2 - security update","status":"published","published":"2023-01-10T00:00:00Z","modified":"2026-03-09T01:18:16.024502Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2019-0415","title":"Updated exiv2 packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\n\nAn integer overflow in Exiv2 through 0.27.1 allows an attacker to cause\na denial of service (SIGSEGV) via a crafted PNG image file, because \nPngImage::readMetadata mishandles a zero value for iccOffset.\n(CVE-2019-13108)\n\nAn integer overflow in Exiv2 through 0.27.1 allows an attacker to cause\na denial of service (SIGSEGV) via a crafted PNG image file, because\nPngImage::readMetadata mishandles a chunkLength - iccOffset subtraction.\n(CVE-2019-13109)\n\nA CiffDirectory::readDirectory integer overflow and out-of-bounds read\nin Exiv2 through 0.27.1 allows an attacker to cause a denial of service\n(SIGSEGV) via a crafted CRW image file. (CVE-2019-13110)\n\nA PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2\nthrough 0.27.1 allows an attacker to cause a denial of service (crash\ndue to an std::bad_alloc exception) via a crafted PNG image file.\n(CVE-2019-13112)\n\nExiv2 through 0.27.1 allows an attacker to cause a denial of service\n(crash due to assertion failure) via an invalid data location in a\nCRW image file. (CVE-2019-13113)\n\nhttp.c in Exiv2 through 0.27.1 allows a malicious http server to cause a\ndenial of service (crash due to a NULL pointer dereference) by returning\na crafted response that lacks a space character. (CVE-2019-13114)\n\nExiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in\ntypes.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory\nin crwimage_int.cpp, because there is no validation of the relationship\nof the total size to the offset and size. (CVE-2019-17402)\n","status":"published","published":"2019-12-31T16:51:17Z","modified":"2026-04-16T04:44:24.278125687Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"SUSE-SU-2020:0860-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\n- CVE-2018-17581: Fixed an excessive stack consumption in CiffDirectory:readDirectory() \n  which might have led to denial of service (bsc#1110282).\n- CVE-2019-13110: Fixed an integer overflow and an out of bounds read in \n  CiffDirectory:readDirectory which might have led to denial of service (bsc#1142678).\n- CVE-2019-13113: Fixed a potential denial of service via an invalid data location \n  in a CRW image (bsc#1142683).\n- CVE-2019-17402: Fixed an improper validation of the relationship of the total \n  size to the offset and size in Exiv2::getULong (bsc#1153577).\n- CVE-2019-20421: Fixed an infinite loop triggered via an input file (bsc#1161901).\n- CVE-2017-9239: Fixed a segmentation fault in TiffImageEntry::doWriteImage function (bsc#1040973).\n","status":"published","published":"2020-04-03T07:01:56Z","modified":"2026-02-04T02:44:58.829105Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2022:4208-1","title":"Security update for exiv2-0_26","description":"This update for exiv2-0_26 fixes the following issues:\n\n- CVE-2019-17402: Fixed improper validation of the total size to the offset and size leads to a crash in Exiv2::getULong in types.cpp (bsc#1153577).\n- CVE-2018-20098: Fixed a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header (bsc#1119560).\n- CVE-2018-17581: Fixed an excessive stack consumption CiffDirectory:readDirectory() at crwimage_int.cpp (bsc#1110282).\n- CVE-2018-20099: exiv2: infinite loop in Exiv2::Jp2Image::encodeJp2Header (bsc#1119559).\n- CVE-2018-20097: Fixed SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroupsu (bsc#1119562).\n- CVE-2017-11591: Fixed a floating point exception in Exiv2::ValueType (bsc#1050257).\n- CVE-2018-11531: Fixed a heap-based buffer overflow in getData in preview.cpp (bsc#1095070).\n- CVE-2021-32815: Fixed a deny-of-service due to assertion failure in crwimage_int.cpp (bsc#1189337).\n- CVE-2021-29473: Fixed out-of-bounds read in Exiv2::Jp2Image:doWriteMetadata (bsc#1186231).\n- CVE-2019-13109: Fixed a denial of service in PngImage:readMetadata (bsc#1142677).\n- CVE-2019-13110: Fixed an integer-overflow and out-of-bounds read in CiffDirectory:readDirectory leads to denail of service (bsc#1142678).\n","status":"published","published":"2022-11-23T16:36:27Z","modified":"2026-02-04T03:24:39.822987Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4276-1","title":"Security update for exiv2","description":"This update for exiv2 fixes the following issues:\n\n- CVE-2019-13110: Fixed an integer-overflow and out-of-bounds read in CiffDirectory:readDirectory leads to denail of service (bsc#1142678).\n- CVE-2019-13109: Fixed a denial of service in PngImage:readMetadata (bsc#1142677).\n- CVE-2018-17581: Fixed an excessive stack consumption CiffDirectory:readDirectory() at crwimage_int.cpp (bsc#1110282).\n- CVE-2017-11591: Fixed a floating point exception in Exiv2::ValueType (bsc#1050257).\n- CVE-2019-17402: Fixed an improper validation of the total size to the offset and size leads to a crash in Exiv2::getULong in types.cpp (bsc#1153577).\n- CVE-2021-32815: Fixed a deny-of-service due to assertion failure in crwimage_int.cpp (bsc#1189337).\n- CVE-2018-20097: Fixed SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroupsu (bsc#1119562).\n- CVE-2021-29473: Fixed out-of-bounds read in Exiv2::Jp2Image:doWriteMetadata (bsc#1186231).\n- CVE-2018-20098: Fixed a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header (bsc#1119560).\n- CVE-2018-11531: Fixed a heap-based buffer overflow in getData in preview.cpp (bsc#1095070).\n- CVE-2018-20099: exiv2: infinite loop in Exiv2::Jp2Image::encodeJp2Header (bsc#1119559).\n","status":"published","published":"2022-11-29T14:36:22Z","modified":"2026-02-04T03:07:13.805781Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-4159-1","title":"exiv2 vulnerability","description":"It was discovered that Exiv2 incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n","status":"published","published":"2019-10-21T14:40:57Z","modified":"2026-04-22T10:01:10.724862Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}