CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure. |
| 30/03/2018 |
| CVE-2018-8977 | MEDIO6.5 | In Exiv2 0.26, the Exiv2::Internal::printCsLensFFFF function in canonmn_int.cpp allows remote attackers to cause a denial of service (invalid memory access) via a crafted file. | 25/03/2018 |
| CVE-2018-8976 | MEDIO6.5 | In Exiv2 0.26, jpgimage.cpp allows remote attackers to cause a denial of service (image.cpp Exiv2::Internal::stringFormat out-of-bounds read) via a crafted file. | 25/03/2018 |
| CVE-2017-17725 | MEDIO6.5 | In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in types.cpp. Remote attackers can exploit the vulnerability to cause a denial of service via a crafted image file. Note that this vulnerability is different from CVE-2017-14864, which is an invalid memo | 12/02/2018 |
| CVE-2017-17724 | MEDIO6.5 | In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, related to the "!= 0x1c" case. Remote attackers can exploit this vulnerability to cause a denial of service via a crafted TIFF file. | 12/02/2018 |
| CVE-2017-17723 | ALTO8.1 | In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attackers can exploit this vulnerability to disclose memory data or cause a denial of service via a crafted TIFF file. | 12/02/2018 |
| CVE-2017-17722 | MEDIO6.5 | In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remote denial of service attack via a crafted TIFF file. | 12/02/2018 |
| CVE-2018-5772 | MEDIO5.5 | In Exiv2 0.26, there is a segmentation fault caused by uncontrolled recursion in the Exiv2::Image::printIFDStructure function in the image.cpp file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file. | 18/01/2018 |
| CVE-2018-4868 | MEDIO5.5 | The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file. | 03/01/2018 |
| CVE-2017-18005 | MEDIO5.5 | Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::DataValue::toLong function in value.cpp, related to crafted metadata in a TIFF file. | 31/12/2017 |
| CVE-2017-17669 | MEDIO5.5 | There is a heap-based buffer over-read in the Exiv2::Internal::PngChunk::keyTXTChunk function of pngchunk_int.cpp in Exiv2 0.26. A crafted PNG file will lead to a remote denial of service attack. | 13/12/2017 |
| CVE-2017-1000128 | MEDIO5.5 | Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser | 17/11/2017 |
| CVE-2017-1000127 | MEDIO5.5 | Exiv2 0.26 contains a heap buffer overflow in tiff parser | 17/11/2017 |
| CVE-2017-1000126 | MEDIO5.5 | exiv2 0.26 contains a Stack out of bounds read in webp parser | 17/11/2017 |
| CVE-2017-14866 | MEDIO5.5 | There is a heap-based buffer overflow in the Exiv2::s2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack. | 29/09/2017 |
| CVE-2017-14865 | MEDIO5.5 | There is a heap-based buffer overflow in the Exiv2::us2Data function of types.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack. | 29/09/2017 |
| CVE-2017-14864 | MEDIO5.5 | An Invalid memory address dereference was discovered in Exiv2::getULong in types.cpp in Exiv2 0.26. The vulnerability causes a segmentation fault and application crash, which leads to denial of service. | 29/09/2017 |