An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8103-1 advisory.

    It was discovered that Exiv2 did not correctly handle reading certain buffers. An attacker could possibly     use this issue to leak sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04     LTS. (CVE-2020-18771)

    Wen Cheng discovered that Exiv2 did not correctly handle certain memory allocation. If a user or system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-18899)

    It was discovered that Exiv2 did not correctly handle writing certain metadata. If a user or system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. (CVE-2025-54080)

    It was discovered that Exiv2 did not correctly handle parsing certain metadata. If a user or system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu     25.10. (CVE-2025-55304)

    It was discovered that Exiv2 did not correctly handle parsing certain images. If a user or system were     tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial     of service. (CVE-2026-25884)

    It was discovered that Exiv2 did not correctly handle previewing certain images. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-27596)

    It was discovered that Exiv2 did not correctly handle certain integer arithmetic. An attacker could     possibly use this issue to cause a denial of service. (CVE-2026-27631)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202312-06 (Exiv2: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Exiv2. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3598-1 advisory.

    - CVE-2021-37621: Fixed denial of service due to infinite loop in Image:printIFDStructure (bsc#1189333).
    - CVE-2021-37620: Fixed out-of-bounds read in XmpTextValue:read() (bsc#1189332).
    - CVE-2021-37619: Fixed out-of-bounds read in Exiv2:Jp2Image:encodeJp2Header (bsc#1189331).
    - CVE-2021-37618: Fixed out-of-bounds read in Exiv2:Jp2Image:printStructure (bsc#1189330).
    - CVE-2021-32617: Fixed denial of service inside inefficient algorithm (quadratic complexity)     (bsc#1186192).
    - CVE-2021-31292: Fixed integer overflow in CrwMap:encode0x1810 (bsc#1188756).
    - CVE-2021-31291: Fixed heap-based buffer overflow vulnerability in jp2image.cpp may lead to a denial of     service (bsc#1188733).
    - CVE-2021-29470: Fixed out-of-bounds read in Exiv2:Jp2Image:encodeJp2Header (bsc#1185447).
    - CVE-2020-18899: Fixed uncontrolled memory allocation (bsc#1189636).
    - CVE-2020-18898: Fixed remote denial of service in printIFDStructure function (bsc#1189780).
    - CVE-2018-8977: Fixed remote denial of service in Exiv2::Internal::printCsLensFFFF function in     canonmn_int.cpp (bsc#1086798).
    - CVE-2018-8976: Fixed remote denial of service in image.cpp Exiv2::Internal::stringFormat via out-of-     bounds read (bsc#1086810).
    - CVE-2018-5772: Fixed segmentation fault caused by uncontrolled recursion inthe     Exiv2::Image::printIFDStructure (bsc#1076579).
    - CVE-2018-18915: Fixed an infinite loop in the Exiv2:Image:printIFDStructure function (bsc#1114690).
    - CVE-2018-10772: Fixed segmentation fault when the function Exiv2::tEXtToDataBuf() is finished     (bsc#1092096).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
303030	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Exiv2 vulnerabilities (USN-8103-1)	Nessus	Ubuntu Local Security Checks	medium
187205	GLSA-202312-06 : Exiv2: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
166183	SUSE SLED15 / SLES15 Security Update : exiv2 (SUSE-SU-2022:3598-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-18899

medium

Tenable Plugins

medium

high

high