摘要:
exiv2 security update
安全等级: Medium
公告ID: KylinSec-SA-2024-4802
发布日期: 2025年2月17日
关联CVE: CVE-2024-39695
Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.
Security Fix(es):
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.(CVE-2024-39695)
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2024-39695 | V6 | exiv2 | Fixed |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| exiv2-help | noarch | 0.28.2-2.ks6 |
| exiv2 | x86_64 | 0.28.2-2.ks6 |
| exiv2-devel | x86_64 | 0.28.2-2.ks6 |
| exiv2 | aarch64 | 0.28.2-3.ks6 |
| exiv2-devel | aarch64 | 0.28.2-3.ks6 |
方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm
方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名
