Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 526
Alerts This Week
Warning Icon 1 526

openSUSE Exiv2 Moderate DoS Buffer Overflow Update 2026-2584-1

opensuse
Calendar Grey June 23, 2026
Dist Opensuse Esm H88
# Security update for exiv2 Announcement ID: SUSE-SU-2026:2584-1 Release Date: 2026-06-23T13:27:50Z
An update that solves four vulnerabilities can now be installed.

Description

This update for exiv2 fixes the following issues

* CVE-2021-34334: DoS due to integer overflow in loop counter (bsc#1189338).

* CVE-2026-25884: out-of-bounds read in `CrwMap: decode0x0805` (bsc#1259083).

* CVE-2026-27596: integer overflow in `LoaderNative: getData()` leads to out-

of-bounds read (bsc#1259084).

* CVE-2026-27631: crash due to uncaught exception when trying to create `std:

vector` larger than `max_size()` (bsc#1259085).

Changes for exiv2:

* Minor bugs and fixes

* Other improvements

* exivsimple has array index errors when stripping quotes form TIFF

parser,Binary array elements should be decoded using the Add option -K Key

(--key Key) to specify one or more keys to "exiv2 -eX" followed by "exiv2

-iX" produces invalid XMP

* This release introduces support for Postscript (EPS) images. XMP metadata

can be read and written from/to EPS images and previews are accessible.

Further it includes a new build environment for MSVC 64 bit

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory moderate buffer overflow DoS OpenSUSE exiv2

Patch

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4

zypper in -t patch SUSE-2026-2584=1

* Desktop Applications Module 15-SP7

zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-2584=1

Package List

* openSUSE Leap 15.4 (aarch64 i586 ppc64le s390x x86_64)

* libexiv2-xmp-static-0.27.5-150400.15.7.1

* exiv2-debugsource-0.27.5-150400.15.7.1

* exiv2-debuginfo-0.27.5-150400.15.7.1

* libexiv2-27-debuginfo-0.27.5-150400.15.7.1

* libexiv2-27-0.27.5-150400.15.7.1

* exiv2-0.27.5-150400.15.7.1

* libexiv2-devel-0.27.5-150400.15.7.1

* openSUSE Leap 15.4 (noarch)

* exiv2-lang-0.27.5-150400.15.7.1

* openSUSE Leap 15.4 (x86_64)

* libexiv2-27-32bit-0.27.5-150400.15.7.1

* libexiv2-27-32bit-debuginfo-0.27.5-150400.15.7.1

* openSUSE Leap 15.4 (aarch64_ilp32)

* libexiv2-27-64bit-debuginfo-0.27.5-150400.15.7.1

* libexiv2-27-64bit-0.27.5-150400.15.7.1

* Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)

* libexiv2-xmp-static-0.27.5-150400.15.7.1

* exiv2-debugsource-0.27.5-150400.15.7.1

* exiv2-debuginfo-0.27.5-150400.15.7.1

* libexiv2-27-debuginfo-0.27.5-150400.15.7.1

* libexiv2-27-0.27.5-150400.15.7.1

* libexiv2-devel-0.27.5-150400.15.7.1

References

* bsc#1189338

* bsc#1259083

* bsc#1259084

* bsc#1259085

## References:

* https://www.suse.com/security/cve/CVE-2021-34334.html

* https://www.suse.com/security/cve/CVE-2026-25884.html

* https://www.suse.com/security/cve/CVE-2026-27596.html

* https://www.suse.com/security/cve/CVE-2026-27631.html

* https://bugzilla.suse.com/show_bug.cgi?id=1189338

* https://bugzilla.suse.com/show_bug.cgi?id=1259083

* https://bugzilla.suse.com/show_bug.cgi?id=1259084

* https://bugzilla.suse.com/show_bug.cgi?id=1259085

Severity
moderate
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:2584-1
Release Date: 2026-06-23T13:27:50Z
Affected Products: * Desktop Applications Module 15-SP7 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7

Topics%20covered

Topics Covered

security advisory moderate buffer overflow DoS OpenSUSE exiv2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.