Exiv2 is a C++ library and set of tools for parsing, editing and saving Exif and IPTC metadata from images.
The following vulnerabilities have been discovered in Exiv2: 2 out of bounds reads, an integer overflow, and an uncaught exception. The worst of which can lead to a Denial of Service via a crash of the program. Please review the CVE identifiers referenced below for details.
The following is a possible outcome: data leakage via an out-of-bounds read or a Denial of Service via a crash of the program.
Avoid using the CLI tool, exiv2, with untrusted files.
All Exiv2 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/exiv2-0.28.8"