Exiv2 0.26 vulnerabilities

There is a heap-based buffer overflow in Exiv2 version 0.26 in basicio.cpp. The vulnerability causes an out-of-bounds write in Exiv2::Image::printIFDStructure(), which may lead to remote denial of service or possibly unspecified other impact.

There is a Mismatched Memory Management Routines vulnerability in the Exiv2::FileIo::seek function of Exiv2 0.26 that will lead to a remote denial of service attack (heap memory corruption) via crafted input.

There is a floating point exception in the Exiv2::ValueType function in Exiv2 version 0.26 that can lead to a remote denial of service attack via crafted input.

There is an illegal address access in the extend_alias_table function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service.

Exiv2 version 0.26 has an invalid free in Image::printIFDStructure that leads to a segmentation fault. Crafted input can lead to a remote denial of service attack.

A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file.

Exiv2 versions 0.28.5 and earlier contain an out-of-bounds read when writing metadata into a crafted image file. This can lead to an application crash (denial of service). The bug is fixed in version 0.28.6.