Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3e44c35f-6cf4-11ef-b813-4ccc6adda413 advisory.

    Kevin Backhouse reports:
    An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability                is in the parser for the ASF video format, which was a new feature in v0.28.0,                so Exiv2 versions before v0.28 are not affected. The out-of-bounds read is                triggered when Exiv2 is used to read the metadata of a crafted video file.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Exiv2 installed on the remote host is prior to 0.28.3. It is, therefore, affected by a vulnerability as referenced in the GHSA-38rv-8x93-pvrh advisory.

  - Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata     of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the     parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered     when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.
    (CVE-2024-39695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libexiv2 installed on the remote host is prior to 0.28.3. It is, therefore, affected by a vulnerability as referenced in the GHSA-38rv-8x93-pvrh advisory.

  - Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata     of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the     parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered     when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.
    (CVE-2024-39695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206769	FreeBSD : exiv2 -- Out-of-bounds read in AsfVideo::streamProperties (3e44c35f-6cf4-11ef-b813-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	medium
204910	Exiv2 0.28.x < 0.28.3 (GHSA-38rv-8x93-pvrh)	Nessus	Misc.	medium
204909	libexiv2 0.28.x < 0.28.3 (GHSA-38rv-8x93-pvrh)	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-39695

medium

Tenable Plugins

medium

medium

medium