openSUSE-SU-2026:21904-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21904-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21904-1

Upstream

CVE (3)

CVE-2026-49275
CVE-2026-68546
CVE-2026-68547

Related

CVE (3)

CVE-2026-49275
CVE-2026-68546
CVE-2026-68547

Published

2026-09-22T07:22:00Z

Modified

2026-09-25T18:23:12Z

Summary

Security update for exiv2

Details

This update for exiv2 fixes the following issues:

CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791).
CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579).
CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591).

Changes for exiv2:

update to 0.28.9:

References

Affected packages

openSUSE:Leap 16.0 / exiv2

Package

Name: exiv2
Purl: pkg:rpm/opensuse/exiv2&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.28.9-160000.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "exiv2":  "0.28.9-160000.1.1",
            "exiv2-lang":  "0.28.9-160000.1.1",
            "libexiv2-28":  "0.28.9-160000.1.1",
            "libexiv2-28-x86-64-v3":  "0.28.9-160000.1.1",
            "libexiv2-devel":  "0.28.9-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21904-1.json"