Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "binaries": [ { "binary_version": "0.25-2.1ubuntu16.04.7+esm4", "binary_name": "exiv2" }, { "binary_version": "0.25-2.1ubuntu16.04.7+esm4", "binary_name": "libexiv2-14" }, { "binary_version": "0.25-2.1ubuntu16.04.7+esm4", "binary_name": "libexiv2-dev" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "0.25-3.1ubuntu0.18.04.11", "binary_name": "exiv2" }, { "binary_version": "0.25-3.1ubuntu0.18.04.11", "binary_name": "libexiv2-14" }, { "binary_version": "0.25-3.1ubuntu0.18.04.11", "binary_name": "libexiv2-dev" } ] }