PT-2025-35224 · Exiv2+5 · Exiv2+5
Gluck-Pwn
·
Publicado
2025-01-01
·
Atualizado
2026-03-23
·
CVE-2025-55304
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Exiv2 versions prior to 0.28.6
Description
Exiv2 is a C++ library and a command-line utility used to read, write, delete, and modify image metadata (Exif, IPTC, XMP, and ICC). A denial-of-service issue was identified in the ICC profile parsing code within the
jpegBase::readMetadata() function. This issue stems from a quadratic algorithm that can cause prolonged execution times when processing crafted JPG image files. The denial-of-service is triggered when Exiv2 attempts to read the metadata of a specially crafted JPG image.Recommendations
Update to Exiv2 version 0.28.6 or later.
Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Debian
Exiv2
Linuxmint
Red Os
Ubuntu