MGASA-2026-0379

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0379.html
Import Source
https://advisories.mageia.org/MGASA-2026-0379.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0379
Upstream
  • CVE-2026-49275
  • CVE-2026-68546
  • CVE-2026-68547
Published
2026-09-07T18:46:11Z
Modified
2026-09-08T12:41:40Z
Summary
Updated exiv2 package fixes security vulnerabilities
Details

Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds). (CVE-2026-68546) Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files. (CVE-2026-68547) Out of bounds read in CrwMap::decodeBasic. (CVE-2026-49275)

References
Credits

Affected packages

Mageia:10 / exiv2

Package

Name
exiv2
Purl
pkg:rpm/mageia/exiv2?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.28.9-1.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0379.json"