Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-e5ab9a2288 advisory.

    Update to exiv2-0.28.7, fixes CVE-2025-54080 and CVE-2025-55304.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-99df814c62 advisory.

    Update to exiv2-0.28.7, fixes CVE-2025-54080 and CVE-2025-55304.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c23727e694 advisory.

    Exiv2 0.28.6 + patch to fix silent abi breakage

    ----

    Exiv2 v0.28.6 (Fixes two low severity CVEs)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 340dc4c1-895a-11f0-b6e5-4ccc6adda413 advisory.

    Kevin Backhouse reports:
    A denial-of-service was found in Exiv2 version v0.28.5: a quadratic               algorithm in the ICC profile parsing code in jpegBase::readMetadata()               can cause Exiv2 to run for a long time. Exiv2 is a command-line utility               and C++ library for reading, writing, deleting, and modifying the               metadata of image files. The denial-of-service is triggered when Exiv2               is used to read the metadata of a crafted jpg image file.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e1ae3d4ed9 advisory.

    Exiv2 0.28.6 + patch to fix silent abi breakage

    ----

    Exiv2 v0.28.6 (Fixes two low severity CVEs)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the     ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-     of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is     fixed in version 0.28.6. (CVE-2025-55304)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-387e64c9fd advisory.

    Exiv2 0.28.6 + patch to fix silent abi breakage

    ----

    Exiv2 v0.28.6 (Fixes two low severity CVEs)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
271171	Fedora 41 : inih / mingw-exiv2 (2025-e5ab9a2288)	Nessus	Fedora Local Security Checks	low
270556	Fedora 42 : inih / mingw-exiv2 (2025-99df814c62)	Nessus	Fedora Local Security Checks	low
264844	Fedora 43 : exiv2 (2025-c23727e694)	Nessus	Fedora Local Security Checks	low
261416	FreeBSD : exiv2 -- Denial-of-service (340dc4c1-895a-11f0-b6e5-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	low
261222	Fedora 41 : exiv2 (2025-e1ae3d4ed9)	Nessus	Fedora Local Security Checks	low
260734	Linux Distros Unpatched Vulnerability : CVE-2025-55304	Nessus	Misc.	low
260148	Fedora 42 : exiv2 (2025-387e64c9fd)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2025-55304

low

Tenable Plugins

low

low

low

low

low

low

low