Security update for exiv2
This update for exiv2 fixes the following issues: - CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic (bsc#1277791). - CVE-2026-68546: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files (bsc#1277579). - CVE-2026-68547: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (bsc#1277591). Changes for exiv2: - update to 0.28.9: * https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52 * https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j * https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649 * https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q * https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2 * https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp * https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w
SUSE-SU-2026:23860-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:23860-1
exiv2
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.28.9-160000.1.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
exiv2
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.28.9-160000.1.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.28.9-160000.1.1"
}
]
}
],
"package": {
"name": "exiv2",
"purl": "pkg:rpm/suse/exiv2&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23860-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libexiv2-28": "0.28.9-160000.1.1",
"libexiv2-28-x86-64-v3": "0.28.9-160000.1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.28.9-160000.1.1"
}
]
}
],
"package": {
"name": "exiv2",
"purl": "pkg:rpm/suse/exiv2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
"ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23860-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libexiv2-28": "0.28.9-160000.1.1",
"libexiv2-28-x86-64-v3": "0.28.9-160000.1.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #20000 · Revision 1
- Added to Heist Feed
- Publisher date