{"schemaVersion":3,"id":"USN-8103-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"exiv2 vulnerabilities\n\nIt was discovered that Exiv2 did not correctly handle reading certain\nbuffers. An attacker could possibly use this issue to leak sensitive\ninformation. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04\nLTS. (CVE-2020-18771)\n\nWen Cheng discovered that Exiv2 did not correctly handle certain memory\nallocation. If a user or system were tricked into opening a specially\ncrafted file, an attacker could possibly use this issue to cause a denial\nof service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n(CVE-2020-18899)\n\nIt was discovered that Exiv2 did not correctly handle writing certain\nmetadata. If a user or system were tricked into opening a specially crafted\nfile, an attacker could possibly use this issue to cause a denial of\nservice. (CVE-2025-54080)\n\nIt was discovered that Exiv2 did not correctly handle parsing certain\nmetadata. If a user or system were tricked into opening a specially crafted\nfile, an attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-55304)\n\nIt was discovered that Exiv2 did not correctly handle parsing certain\nimages. If a user or system were tricked into opening a specially crafted\nfile, an attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-25884)\n\nIt was discovered that Exiv2 did not correctly handle previewing certain\nimages. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-27596)\n\nIt was discovered that Exiv2 did not correctly handle certain integer\narithmetic. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-27631)","dates":{"published":"2026-03-18T02:55:39.000Z","modified":"2026-06-25T13:32:31.985Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"exiv2","name":"exiv2","label":"exiv2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/exiv2","purlType":"deb","versions":[{"text":"< 0.25-2.1ubuntu16.04.7+esm5","noFixRecorded":false,"fixedIn":null},{"text":"< 0.25-3.1ubuntu0.18.04.11+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.27.2-8ubuntu2.7+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.27.5-3ubuntu1.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.27.6-1ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.28.5+dfsg-1ubuntu0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.25-2.1ubuntu16.04.7+esm5 | < 0.25-3.1ubuntu0.18.04.11+esm1 | < 0.27.2-8ubuntu2.7+esm1 | < 0.27.5-3ubuntu1.1 | < 0.27.6-1ubuntu0.1 | < 0.28.5+dfsg-1ubuntu0.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8103-1","label":"ubuntu.com/security/notices/USN-8103-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-18771","label":"ubuntu.com/security/CVE-2020-18771","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2020-18899","label":"ubuntu.com/security/CVE-2020-18899","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-54080","label":"ubuntu.com/security/CVE-2025-54080","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2025-55304","label":"ubuntu.com/security/CVE-2025-55304","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-25884","label":"ubuntu.com/security/CVE-2026-25884","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-27596","label":"ubuntu.com/security/CVE-2026-27596","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-27631","label":"ubuntu.com/security/CVE-2026-27631","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2020-18771","CVE-2020-18899","CVE-2025-54080","CVE-2025-55304","CVE-2026-25884","CVE-2026-27596","CVE-2026-27631"]},"timeline":[{"kind":"published","date":"2026-03-18T02:55:39.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-25T13:32:31.985Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T19:10:26.364Z","stale":false,"partial":false}}