Description
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-service is triggered when Exiv2 is used to read the metadata of a crafted jpg image file. The bug is fixed in version 0.28.6.
Problem types
CWE-407: Inefficient Algorithmic Complexity
Product status
References
github.com/.../exiv2/security/advisories/GHSA-m54q-mm9w-fp6g
github.com/Exiv2/exiv2/issues/3333
github.com/Exiv2/exiv2/pull/3335
github.com/Exiv2/exiv2/pull/3345
