CVE-2025-26623

criticalPriorität · verfolgen · 39EPSS 0.009 · 60. PerzentilDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.92% (60th) EPSS
CVSS 9.8 · critical
Is it mine?
48 products
Prüfe deine Angriffsfläche
Who says so?
8 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-26

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4. Versions prior to v0.28.0, such as v0.27.7, are **not** affected. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `fixiso`. The bug is fixed in version v0.28.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenexiv2-0:0.28.3-3.el10_0.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-0:0.28.3-3.el10_0.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-0:0.28.3-3.el10_0.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-0:0.28.3-3.el10_0.2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-0:0.28.3-3.el10_0.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debuginfo-0:0.28.3-3.el10_0.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debuginfo-0:0.28.3-3.el10_0.2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debuginfo-0:0.28.3-3.el10_0.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debuginfo-0:0.28.3-3.el10_0.2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debuginfo-0:0.28.3-3.el10_0.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debuginfo-0:0.28.3-3.el10_0.2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debuginfo-0:0.28.3-3.el10_0.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debuginfo-0:0.28.3-3.el10_0.2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debugsource-0:0.28.3-3.el10_0.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debugsource-0:0.28.3-3.el10_0.2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debugsource-0:0.28.3-3.el10_0.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debugsource-0:0.28.3-3.el10_0.2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debugsource-0:0.28.3-3.el10_0.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debugsource-0:0.28.3-3.el10_0.2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debugsource-0:0.28.3-3.el10_0.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-debugsource-0:0.28.3-3.el10_0.2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-devel-0:0.28.3-3.el10_0.2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-devel-0:0.28.3-3.el10_0.2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-devel-0:0.28.3-3.el10_0.2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-devel-0:0.28.3-3.el10_0.2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-doc-0:0.28.3-3.el10_0.2.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-0:0.28.3-3.el10_0.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-0:0.28.3-3.el10_0.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-0:0.28.3-3.el10_0.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-0:0.28.3-3.el10_0.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-debuginfo-0:0.28.3-3.el10_0.2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-debuginfo-0:0.28.3-3.el10_0.2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-debuginfo-0:0.28.3-3.el10_0.2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-debuginfo-0:0.28.3-3.el10_0.2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-debuginfo-0:0.28.3-3.el10_0.2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-debuginfo-0:0.28.3-3.el10_0.2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-debuginfo-0:0.28.3-3.el10_0.2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenexiv2-libs-debuginfo-0:0.28.3-3.el10_0.2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2025:7457
  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-x86-64-v3-0:0.28.8-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-x86-64-v3-0:0.28.8-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-0:0.28.8-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-0:0.28.8-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-0:0.28.8-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-0:0.28.8-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-lang-0:0.28.8-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-lang-0:0.28.8-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-lang-0:0.28.8-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-lang-0:0.28.8-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-x86-64-v3-0:0.28.8-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-x86-64-v3-0:0.28.8-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-x86-64-v3-0:0.28.8-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-x86-64-v3-0:0.28.8-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-devel-0:0.28.8-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-devel-0:0.28.8-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-devel-0:0.28.8-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-devel-0:0.28.8-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-0:0.28.8-160000.1.1.aarch64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-0:0.28.8-160000.1.1.ppc64le as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-0:0.28.8-160000.1.1.s390x as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-0:0.28.8-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenexiv2-lang-0:0.28.8-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.aarch64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.ppc64le as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.s390x as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-0:0.28.8-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-28-x86-64-v3-0:0.28.8-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-devel-0:0.28.8-160000.1.1.aarch64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-devel-0:0.28.8-160000.1.1.ppc64le as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-devel-0:0.28.8-160000.1.1.s390x as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

  • Behobenlibexiv2-devel-0:0.28.8-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf

    To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–critical · 1.3–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9
v3.16.3mediumAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU
v3.17highCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · SUSE Product Security
v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · Red Hat Product Security US
v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com
v4.05.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.01.3lowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-416USCWE-416USCWE-416USCWE-416US
05

betroffene Produkte (48)

Betroffene Produkte und Versionsbereiche.

20 von 48 angezeigt
06

Advisories (7)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2025:7457Red Hat Security Advisory: exiv2 security update2025-05-13csaf · redhat_csafUS

    An update for exiv2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • SUSE-SU-2026:20923-1Security update for exiv22026-03-23csaf · suse_csafDE

    Security update for exiv2

  • WID-SEC-W-2025-1047Red Hat Enterprise Linux (exiv2): Schwachstelle ermöglicht CodeausführungDeutsch2025-05-13csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux Exiv2 ausnutzen, um beliebigen Programmcode auszuführen.

  • openSUSE-SU-2026:10298-1exiv2-0.28.8-1.1 on GA media2026-03-07csaf · suse_csafDE

    exiv2-0.28.8-1.1 on GA media

  • openSUSE-SU-2026:20410-1Security update for exiv22026-03-23csaf · suse_csafDE

    Security update for exiv2

  • GHSA-38h4-fx85-qcx7Exiv2 allows Use After Free2025-02-21ghsa · osvUS

    ### Impact A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4. Versions prior to v0.28.0, such as v0.27.7, are **not** affected. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `fixiso`. ### Patches The bug is fixed in version v0.28.5. ### References Issue: https://github.com/Exiv2/exiv2/issues/3168 Fix: https://github.com/Exiv2/exiv2/pull/3174 ### For more information Please see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.

  • PYSEC-2026-1353Exiv2 allows Use After Free2026-07-07vendor · osvUS

    ### Impact A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4. Versions prior to v0.28.0, such as v0.27.7, are **not** affected. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `fixiso`. ### Patches The bug is fixed in version v0.28.5. ### References Issue: https://github.com/Exiv2/exiv2/issues/3168 Fix: https://github.com/Exiv2/exiv2/pull/3174 ### For more information Please see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.

07

auch bekannt als (7)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduosvcert_bundnvdredhat_csafsuse_csafNVDCVE.orgMITRE
veröffentlicht 2025-02-18geändert 2026-06-17
09

Referenzen (9)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan