Out-of-Bounds Read Vulnerability in Exiv2 Package
Summary
DEBIAN-CVE-2024-24826: Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. Affects exiv2 versions < 0.28.3+dfsg-2. Fixed in 0.28.3+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Exiv2 is a command-line utility and C++ library designed for reading, writing, deleting, and modifying the metadata of image files. It supports various image formats and is widely used for managing image metadata. The package is crucial for applications that require metadata manipulation, but it has been found to have a vulnerability that could lead to crashes when processing specially crafted video files.
Vulnerability Detail
The vulnerability identified in Exiv2 is an out-of-bounds read that occurs in the function QuickTimeVideo::NikonTagsDecoder, introduced in version v0.28.0. This issue allows an attacker to craft a video file that, when processed by Exiv2, triggers an out-of-bounds read, potentially leading to application crashes. Versions prior to v0.28 are not affected, and the bug has been fixed in version v0.28.2.
How To Fix
Minimum fixed version
0.28.3+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade exiv2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to upgrade to the fixed version as soon as possible.
Conclusion
The out-of-bounds read vulnerability in Exiv2 poses a significant risk to applications that utilize this package for metadata manipulation. Users are strongly advised to upgrade to the latest version to mitigate potential crashes and ensure the security of their applications.
See every vulnerability recorded for exiv2 →
FAQ
The vulnerability is an out-of-bounds read that can lead to application crashes when processing specially crafted video files.
Exiv2 versions prior to v0.28.2 are affected. Versions 0.28.0 and 0.28.1 contain the vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
It is recommended to upgrade to the patched version as soon as possible, as there are no known workarounds for this vulnerability.
More information can be found in the official Debian CVE database or by checking the Exiv2 project documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for exiv2.
