csaf_suse - suse-su-2022:3889-1

Vulnerability from csaf_suse

Published

2022-11-07 14:26

Modified

2022-11-07 14:26

Summary

Security update for exiv2

Notes

Title of the patch

Security update for exiv2

Description of the patch

This update for exiv2 fixes the following issues: Updated to version 0.27.5 (jsc#PED-1393): - CVE-2017-1000128: Fixed stack out of bounds read in JPEG2000 parser (bsc#1068871). - CVE-2019-13108: Fixed integer overflow PngImage:readMetadata (bsc#1142675). - CVE-2020-19716: Fixed buffer overflow vulnerability in the Databuf function in types.cpp (bsc#1188645). - CVE-2021-29457: Fixed heap buffer overflow when write metadata into a crafted image file (bsc#1185002). - CVE-2021-29470: Fixed out-of-bounds read in Exiv2:Jp2Image:encodeJp2Header (bsc#1185447). - CVE-2021-29623: Fixed read of uninitialized memory (bsc#1186053). - CVE-2021-31291: Fixed heap-based buffer overflow in jp2image.cpp (bsc#1188733). - CVE-2021-32617: Fixed denial of service due to inefficient algorithm (bsc#1186192). - CVE-2021-37620: Fixed out-of-bounds read in XmpTextValue:read() (bsc#1189332). - CVE-2021-37621: Fixed DoS due to infinite loop in Image:printIFDStructure (bsc#1189333). - CVE-2021-37622: Fixed DoS due to infinite loop in JpegBase:printStructure (bsc#1189334) - CVE-2021-34334: Fixed DoS due to integer overflow in loop counter(bsc#1189338) - CVE-2021-37623: Fixed DoS due to infinite loop in JpegBase:printStructure (bsc#1189335) - CVE-2021-29463: Fixed out-of-bounds read in webpimage.cpp (bsc#1185913). - CVE-2021-34334: Fixed DoS due to integer overflow in loop counter (bsc#1189338) - CVE-2019-13111: Fixed integer overflow in WebPImage:decodeChunks that lead to denial of service (bsc#1142679) - CVE-2021-29463: Fixed an out-of-bounds read was found in webpimage.cpp (bsc#1185913) Bugfixes: - Fixed build using GCC 11 (bsc#1185218). A new libexiv2-2_27 shared library is shipped, the libexiv2-2_26 is provided only for compatibility now. Please recompile your applications using the exiv2 library.

Patchnames

SUSE-2022-3889,SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-3889,openSUSE-SLE-15.4-2022-3889

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for exiv2",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for exiv2 fixes the following issues:\n\nUpdated to version 0.27.5 (jsc#PED-1393):\n\n- CVE-2017-1000128: Fixed stack out of bounds read in JPEG2000 parser (bsc#1068871).\n- CVE-2019-13108: Fixed integer overflow PngImage:readMetadata (bsc#1142675).\n- CVE-2020-19716: Fixed buffer overflow vulnerability in the Databuf function in types.cpp (bsc#1188645).\n- CVE-2021-29457: Fixed heap buffer overflow when write metadata into a crafted image file (bsc#1185002).\n- CVE-2021-29470: Fixed out-of-bounds read in Exiv2:Jp2Image:encodeJp2Header (bsc#1185447).\n- CVE-2021-29623: Fixed read of uninitialized memory (bsc#1186053).\n- CVE-2021-31291: Fixed heap-based buffer overflow in jp2image.cpp (bsc#1188733).\n- CVE-2021-32617: Fixed denial of service due to inefficient algorithm (bsc#1186192).\n- CVE-2021-37620: Fixed out-of-bounds read in XmpTextValue:read() (bsc#1189332).\n- CVE-2021-37621: Fixed DoS due to infinite loop in Image:printIFDStructure (bsc#1189333).\n- CVE-2021-37622: Fixed DoS due to infinite loop in JpegBase:printStructure (bsc#1189334)\n- CVE-2021-34334: Fixed DoS due to integer overflow in loop counter(bsc#1189338)\n- CVE-2021-37623: Fixed DoS due to infinite loop in JpegBase:printStructure (bsc#1189335)\n- CVE-2021-29463: Fixed out-of-bounds read in webpimage.cpp (bsc#1185913).\n- CVE-2021-34334: Fixed DoS due to integer overflow in loop counter (bsc#1189338)\n- CVE-2019-13111: Fixed integer overflow in WebPImage:decodeChunks that lead to denial of service (bsc#1142679)\n- CVE-2021-29463: Fixed an out-of-bounds read was found in webpimage.cpp (bsc#1185913)\n\nBugfixes:\n\n- Fixed build using GCC 11 (bsc#1185218).\n\nA new libexiv2-2_27 shared library is shipped, the libexiv2-2_26 is provided only for compatibility now.\n\nPlease recompile your applications using the exiv2 library.\n\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2022-3889,SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-3889,openSUSE-SLE-15.4-2022-3889",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3889-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2022:3889-1",
            url: "https://www.suse.com/support/update/announcement/2022/suse-su-20223889-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2022:3889-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012825.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1068871",
            url: "https://bugzilla.suse.com/1068871",
         },
         {
            category: "self",
            summary: "SUSE Bug 1142675",
            url: "https://bugzilla.suse.com/1142675",
         },
         {
            category: "self",
            summary: "SUSE Bug 1142679",
            url: "https://bugzilla.suse.com/1142679",
         },
         {
            category: "self",
            summary: "SUSE Bug 1185002",
            url: "https://bugzilla.suse.com/1185002",
         },
         {
            category: "self",
            summary: "SUSE Bug 1185218",
            url: "https://bugzilla.suse.com/1185218",
         },
         {
            category: "self",
            summary: "SUSE Bug 1185447",
            url: "https://bugzilla.suse.com/1185447",
         },
         {
            category: "self",
            summary: "SUSE Bug 1185913",
            url: "https://bugzilla.suse.com/1185913",
         },
         {
            category: "self",
            summary: "SUSE Bug 1186053",
            url: "https://bugzilla.suse.com/1186053",
         },
         {
            category: "self",
            summary: "SUSE Bug 1186192",
            url: "https://bugzilla.suse.com/1186192",
         },
         {
            category: "self",
            summary: "SUSE Bug 1188645",
            url: "https://bugzilla.suse.com/1188645",
         },
         {
            category: "self",
            summary: "SUSE Bug 1188733",
            url: "https://bugzilla.suse.com/1188733",
         },
         {
            category: "self",
            summary: "SUSE Bug 1189332",
            url: "https://bugzilla.suse.com/1189332",
         },
         {
            category: "self",
            summary: "SUSE Bug 1189333",
            url: "https://bugzilla.suse.com/1189333",
         },
         {
            category: "self",
            summary: "SUSE Bug 1189334",
            url: "https://bugzilla.suse.com/1189334",
         },
         {
            category: "self",
            summary: "SUSE Bug 1189335",
            url: "https://bugzilla.suse.com/1189335",
         },
         {
            category: "self",
            summary: "SUSE Bug 1189338",
            url: "https://bugzilla.suse.com/1189338",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-1000128 page",
            url: "https://www.suse.com/security/cve/CVE-2017-1000128/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-13108 page",
            url: "https://www.suse.com/security/cve/CVE-2019-13108/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-13111 page",
            url: "https://www.suse.com/security/cve/CVE-2019-13111/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-19716 page",
            url: "https://www.suse.com/security/cve/CVE-2020-19716/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-29457 page",
            url: "https://www.suse.com/security/cve/CVE-2021-29457/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-29463 page",
            url: "https://www.suse.com/security/cve/CVE-2021-29463/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-29470 page",
            url: "https://www.suse.com/security/cve/CVE-2021-29470/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-29623 page",
            url: "https://www.suse.com/security/cve/CVE-2021-29623/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-31291 page",
            url: "https://www.suse.com/security/cve/CVE-2021-31291/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-32617 page",
            url: "https://www.suse.com/security/cve/CVE-2021-32617/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-34334 page",
            url: "https://www.suse.com/security/cve/CVE-2021-34334/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-37620 page",
            url: "https://www.suse.com/security/cve/CVE-2021-37620/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-37621 page",
            url: "https://www.suse.com/security/cve/CVE-2021-37621/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-37622 page",
            url: "https://www.suse.com/security/cve/CVE-2021-37622/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2021-37623 page",
            url: "https://www.suse.com/security/cve/CVE-2021-37623/",
         },
      ],
      title: "Security update for exiv2",
      tracking: {
         current_release_date: "2022-11-07T14:26:03Z",
         generator: {
            date: "2022-11-07T14:26:03Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2022:3889-1",
         initial_release_date: "2022-11-07T14:26:03Z",
         revision_history: [
            {
               date: "2022-11-07T14:26:03Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "exiv2-0.27.5-150400.15.4.1.aarch64",
                        product: {
                           name: "exiv2-0.27.5-150400.15.4.1.aarch64",
                           product_id: "exiv2-0.27.5-150400.15.4.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-26-0.26-150400.9.16.1.aarch64",
                        product: {
                           name: "libexiv2-26-0.26-150400.9.16.1.aarch64",
                           product_id: "libexiv2-26-0.26-150400.9.16.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                        product: {
                           name: "libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                           product_id: "libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                        product: {
                           name: "libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                           product_id: "libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                        product: {
                           name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                           product_id: "libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libexiv2-26-64bit-0.26-150400.9.16.1.aarch64_ilp32",
                        product: {
                           name: "libexiv2-26-64bit-0.26-150400.9.16.1.aarch64_ilp32",
                           product_id: "libexiv2-26-64bit-0.26-150400.9.16.1.aarch64_ilp32",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-27-64bit-0.27.5-150400.15.4.1.aarch64_ilp32",
                        product: {
                           name: "libexiv2-27-64bit-0.27.5-150400.15.4.1.aarch64_ilp32",
                           product_id: "libexiv2-27-64bit-0.27.5-150400.15.4.1.aarch64_ilp32",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64_ilp32",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "exiv2-0.27.5-150400.15.4.1.i586",
                        product: {
                           name: "exiv2-0.27.5-150400.15.4.1.i586",
                           product_id: "exiv2-0.27.5-150400.15.4.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-26-0.26-150400.9.16.1.i586",
                        product: {
                           name: "libexiv2-26-0.26-150400.9.16.1.i586",
                           product_id: "libexiv2-26-0.26-150400.9.16.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-27-0.27.5-150400.15.4.1.i586",
                        product: {
                           name: "libexiv2-27-0.27.5-150400.15.4.1.i586",
                           product_id: "libexiv2-27-0.27.5-150400.15.4.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-devel-0.27.5-150400.15.4.1.i586",
                        product: {
                           name: "libexiv2-devel-0.27.5-150400.15.4.1.i586",
                           product_id: "libexiv2-devel-0.27.5-150400.15.4.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.i586",
                        product: {
                           name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.i586",
                           product_id: "libexiv2-xmp-static-0.27.5-150400.15.4.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "exiv2-lang-0.27.5-150400.15.4.1.noarch",
                        product: {
                           name: "exiv2-lang-0.27.5-150400.15.4.1.noarch",
                           product_id: "exiv2-lang-0.27.5-150400.15.4.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "exiv2-0.27.5-150400.15.4.1.ppc64le",
                        product: {
                           name: "exiv2-0.27.5-150400.15.4.1.ppc64le",
                           product_id: "exiv2-0.27.5-150400.15.4.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-26-0.26-150400.9.16.1.ppc64le",
                        product: {
                           name: "libexiv2-26-0.26-150400.9.16.1.ppc64le",
                           product_id: "libexiv2-26-0.26-150400.9.16.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                        product: {
                           name: "libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                           product_id: "libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                        product: {
                           name: "libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                           product_id: "libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                        product: {
                           name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                           product_id: "libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "exiv2-0.27.5-150400.15.4.1.s390x",
                        product: {
                           name: "exiv2-0.27.5-150400.15.4.1.s390x",
                           product_id: "exiv2-0.27.5-150400.15.4.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-26-0.26-150400.9.16.1.s390x",
                        product: {
                           name: "libexiv2-26-0.26-150400.9.16.1.s390x",
                           product_id: "libexiv2-26-0.26-150400.9.16.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-27-0.27.5-150400.15.4.1.s390x",
                        product: {
                           name: "libexiv2-27-0.27.5-150400.15.4.1.s390x",
                           product_id: "libexiv2-27-0.27.5-150400.15.4.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                        product: {
                           name: "libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                           product_id: "libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                        product: {
                           name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                           product_id: "libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "exiv2-0.27.5-150400.15.4.1.x86_64",
                        product: {
                           name: "exiv2-0.27.5-150400.15.4.1.x86_64",
                           product_id: "exiv2-0.27.5-150400.15.4.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-26-0.26-150400.9.16.1.x86_64",
                        product: {
                           name: "libexiv2-26-0.26-150400.9.16.1.x86_64",
                           product_id: "libexiv2-26-0.26-150400.9.16.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                        product: {
                           name: "libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                           product_id: "libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                        product: {
                           name: "libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                           product_id: "libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                        product: {
                           name: "libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                           product_id: "libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                        product: {
                           name: "libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                           product_id: "libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                        product: {
                           name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                           product_id: "libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
                        product: {
                           name: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
                           product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-desktop-applications:15:sp4",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.4",
                        product: {
                           name: "openSUSE Leap 15.4",
                           product_id: "openSUSE Leap 15.4",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.4",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-26-0.26-150400.9.16.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
            },
            product_reference: "libexiv2-26-0.26-150400.9.16.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-26-0.26-150400.9.16.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
            },
            product_reference: "libexiv2-26-0.26-150400.9.16.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-26-0.26-150400.9.16.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
            },
            product_reference: "libexiv2-26-0.26-150400.9.16.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-26-0.26-150400.9.16.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
            },
            product_reference: "libexiv2-26-0.26-150400.9.16.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-27-0.27.5-150400.15.4.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
            },
            product_reference: "libexiv2-27-0.27.5-150400.15.4.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-27-0.27.5-150400.15.4.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
            },
            product_reference: "libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-27-0.27.5-150400.15.4.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
            },
            product_reference: "libexiv2-27-0.27.5-150400.15.4.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-27-0.27.5-150400.15.4.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
            },
            product_reference: "libexiv2-27-0.27.5-150400.15.4.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-devel-0.27.5-150400.15.4.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
            },
            product_reference: "libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-devel-0.27.5-150400.15.4.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
            },
            product_reference: "libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-devel-0.27.5-150400.15.4.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
            },
            product_reference: "libexiv2-devel-0.27.5-150400.15.4.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-devel-0.27.5-150400.15.4.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
            },
            product_reference: "libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
            },
            product_reference: "libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
            },
            product_reference: "libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
            },
            product_reference: "libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64 as component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
               product_id: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            },
            product_reference: "libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Desktop Applications 15 SP4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "exiv2-0.27.5-150400.15.4.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
            },
            product_reference: "exiv2-0.27.5-150400.15.4.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "exiv2-0.27.5-150400.15.4.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
            },
            product_reference: "exiv2-0.27.5-150400.15.4.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "exiv2-0.27.5-150400.15.4.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
            },
            product_reference: "exiv2-0.27.5-150400.15.4.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "exiv2-0.27.5-150400.15.4.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
            },
            product_reference: "exiv2-0.27.5-150400.15.4.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "exiv2-lang-0.27.5-150400.15.4.1.noarch as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
            },
            product_reference: "exiv2-lang-0.27.5-150400.15.4.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-26-0.26-150400.9.16.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
            },
            product_reference: "libexiv2-26-0.26-150400.9.16.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-26-0.26-150400.9.16.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
            },
            product_reference: "libexiv2-26-0.26-150400.9.16.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-26-0.26-150400.9.16.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
            },
            product_reference: "libexiv2-26-0.26-150400.9.16.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-26-0.26-150400.9.16.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
            },
            product_reference: "libexiv2-26-0.26-150400.9.16.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-26-32bit-0.26-150400.9.16.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
            },
            product_reference: "libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-27-0.27.5-150400.15.4.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
            },
            product_reference: "libexiv2-27-0.27.5-150400.15.4.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-27-0.27.5-150400.15.4.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
            },
            product_reference: "libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-27-0.27.5-150400.15.4.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
            },
            product_reference: "libexiv2-27-0.27.5-150400.15.4.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-27-0.27.5-150400.15.4.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
            },
            product_reference: "libexiv2-27-0.27.5-150400.15.4.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
            },
            product_reference: "libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-devel-0.27.5-150400.15.4.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
            },
            product_reference: "libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-devel-0.27.5-150400.15.4.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
            },
            product_reference: "libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-devel-0.27.5-150400.15.4.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
            },
            product_reference: "libexiv2-devel-0.27.5-150400.15.4.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-devel-0.27.5-150400.15.4.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
            },
            product_reference: "libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
            },
            product_reference: "libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
            },
            product_reference: "libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
            },
            product_reference: "libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64 as component of openSUSE Leap 15.4",
               product_id: "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            },
            product_reference: "libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.4",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2017-1000128",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-1000128",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-1000128",
               url: "https://www.suse.com/security/cve/CVE-2017-1000128",
            },
            {
               category: "external",
               summary: "SUSE Bug 1068871 for CVE-2017-1000128",
               url: "https://bugzilla.suse.com/1068871",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-1000128",
      },
      {
         cve: "CVE-2019-13108",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-13108",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-13108",
               url: "https://www.suse.com/security/cve/CVE-2019-13108",
            },
            {
               category: "external",
               summary: "SUSE Bug 1142675 for CVE-2019-13108",
               url: "https://bugzilla.suse.com/1142675",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2019-13108",
      },
      {
         cve: "CVE-2019-13111",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-13111",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-13111",
               url: "https://www.suse.com/security/cve/CVE-2019-13111",
            },
            {
               category: "external",
               summary: "SUSE Bug 1142679 for CVE-2019-13111",
               url: "https://bugzilla.suse.com/1142679",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2019-13111",
      },
      {
         cve: "CVE-2020-19716",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-19716",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-19716",
               url: "https://www.suse.com/security/cve/CVE-2020-19716",
            },
            {
               category: "external",
               summary: "SUSE Bug 1188645 for CVE-2020-19716",
               url: "https://bugzilla.suse.com/1188645",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-19716",
      },
      {
         cve: "CVE-2021-29457",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-29457",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-29457",
               url: "https://www.suse.com/security/cve/CVE-2021-29457",
            },
            {
               category: "external",
               summary: "SUSE Bug 1185002 for CVE-2021-29457",
               url: "https://bugzilla.suse.com/1185002",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "important",
            },
         ],
         title: "CVE-2021-29457",
      },
      {
         cve: "CVE-2021-29463",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-29463",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-29463",
               url: "https://www.suse.com/security/cve/CVE-2021-29463",
            },
            {
               category: "external",
               summary: "SUSE Bug 1185913 for CVE-2021-29463",
               url: "https://bugzilla.suse.com/1185913",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-29463",
      },
      {
         cve: "CVE-2021-29470",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-29470",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.4.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-29470",
               url: "https://www.suse.com/security/cve/CVE-2021-29470",
            },
            {
               category: "external",
               summary: "SUSE Bug 1185447 for CVE-2021-29470",
               url: "https://bugzilla.suse.com/1185447",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.7,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-29470",
      },
      {
         cve: "CVE-2021-29623",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-29623",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-29623",
               url: "https://www.suse.com/security/cve/CVE-2021-29623",
            },
            {
               category: "external",
               summary: "SUSE Bug 1186053 for CVE-2021-29623",
               url: "https://bugzilla.suse.com/1186053",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.8,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-29623",
      },
      {
         cve: "CVE-2021-31291",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-31291",
            },
         ],
         notes: [
            {
               category: "general",
               text: "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-31291",
               url: "https://www.suse.com/security/cve/CVE-2021-31291",
            },
            {
               category: "external",
               summary: "SUSE Bug 1188733 for CVE-2021-31291",
               url: "https://bugzilla.suse.com/1188733",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-31291",
      },
      {
         cve: "CVE-2021-32617",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-32617",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `rm`.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-32617",
               url: "https://www.suse.com/security/cve/CVE-2021-32617",
            },
            {
               category: "external",
               summary: "SUSE Bug 1186192 for CVE-2021-32617",
               url: "https://bugzilla.suse.com/1186192",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-32617",
      },
      {
         cve: "CVE-2021-34334",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-34334",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-34334",
               url: "https://www.suse.com/security/cve/CVE-2021-34334",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189338 for CVE-2021-34334",
               url: "https://bugzilla.suse.com/1189338",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-34334",
      },
      {
         cve: "CVE-2021-37620",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-37620",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-37620",
               url: "https://www.suse.com/security/cve/CVE-2021-37620",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189332 for CVE-2021-37620",
               url: "https://bugzilla.suse.com/1189332",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.1,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "low",
            },
         ],
         title: "CVE-2021-37620",
      },
      {
         cve: "CVE-2021-37621",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-37621",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p C`). The bug is fixed in version v0.27.5.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-37621",
               url: "https://www.suse.com/security/cve/CVE-2021-37621",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189333 for CVE-2021-37621",
               url: "https://bugzilla.suse.com/1189333",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.4,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-37621",
      },
      {
         cve: "CVE-2021-37622",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-37622",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-37622",
               url: "https://www.suse.com/security/cve/CVE-2021-37622",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189334 for CVE-2021-37622",
               url: "https://bugzilla.suse.com/1189334",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-37622",
      },
      {
         cve: "CVE-2021-37623",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2021-37623",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
               "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
               "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2021-37623",
               url: "https://www.suse.com/security/cve/CVE-2021-37623",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189335 for CVE-2021-37623",
               url: "https://bugzilla.suse.com/1189335",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "SUSE Linux Enterprise Module for Desktop Applications 15 SP4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:exiv2-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:exiv2-lang-0.27.5-150400.15.4.1.noarch",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-26-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-26-32bit-0.26-150400.9.16.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-27-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-27-32bit-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-devel-0.27.5-150400.15.4.1.x86_64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.aarch64",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.ppc64le",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.s390x",
                  "openSUSE Leap 15.4:libexiv2-xmp-static-0.27.5-150400.15.4.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-11-07T14:26:03Z",
               details: "moderate",
            },
         ],
         title: "CVE-2021-37623",
      },
   ],
}

cve-2019-13108

Vulnerability from cvelistv5

Published

2019-06-30 22:19

Modified

2024-08-04 23:41

Severity ?

Summary

An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/issues/789	x_refsource_MISC
	https://github.com/Exiv2/exiv2/pull/794	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T23:41:10.478Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/issues/789",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/794",
               },
               {
                  name: "FEDORA-2019-60553d5a18",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-08-09T02:06:05",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/Exiv2/exiv2/issues/789",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/Exiv2/exiv2/pull/794",
            },
            {
               name: "FEDORA-2019-60553d5a18",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2019-13108",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetadata mishandles a zero value for iccOffset.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/Exiv2/exiv2/issues/789",
                     refsource: "MISC",
                     url: "https://github.com/Exiv2/exiv2/issues/789",
                  },
                  {
                     name: "https://github.com/Exiv2/exiv2/pull/794",
                     refsource: "MISC",
                     url: "https://github.com/Exiv2/exiv2/pull/794",
                  },
                  {
                     name: "FEDORA-2019-60553d5a18",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2019-13108",
      datePublished: "2019-06-30T22:19:48",
      dateReserved: "2019-06-30T00:00:00",
      dateUpdated: "2024-08-04T23:41:10.478Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-19716

Vulnerability from cvelistv5

Published

2021-07-13 00:00

Modified

2024-08-04 14:15

Severity ?

Summary

A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS).

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/issues/980
	https://lists.debian.org/debian-lts-announce/2022/11/msg00013.html	mailing-list

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T14:15:28.465Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/issues/980",
               },
               {
                  name: "[debian-lts-announce] 20221110 [SECURITY] [DLA 3186-1] exiv2 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/11/msg00013.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS).",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-11-10T00:00:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/issues/980",
            },
            {
               name: "[debian-lts-announce] 20221110 [SECURITY] [DLA 3186-1] exiv2 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/11/msg00013.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2020-19716",
      datePublished: "2021-07-13T00:00:00",
      dateReserved: "2020-08-13T00:00:00",
      dateUpdated: "2024-08-04T14:15:28.465Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-29470

Vulnerability from cvelistv5

Published

2021-04-23 00:00

Modified

2024-08-03 22:11

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.4.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj
	https://github.com/Exiv2/exiv2/pull/1581
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWZLDECIXXW3CCZ3RS4A3NG5X5VE4WZM/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBKWLTXM7IKZ4PVGKLUQVAVFAYGGF7QR/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/	vendor-advisory
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: <= 0.27.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T22:11:05.421Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/1581",
               },
               {
                  name: "FEDORA-2021-10d7331a31",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/",
               },
               {
                  name: "FEDORA-2021-2d860da728",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWZLDECIXXW3CCZ3RS4A3NG5X5VE4WZM/",
               },
               {
                  name: "FEDORA-2021-96a5dabcfa",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBKWLTXM7IKZ4PVGKLUQVAVFAYGGF7QR/",
               },
               {
                  name: "FEDORA-2021-be94728b95",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "<= 0.27.3",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.4.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 4.7,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125 Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:34.408177",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-8949-hhfh-j7rj",
            },
            {
               url: "https://github.com/Exiv2/exiv2/pull/1581",
            },
            {
               name: "FEDORA-2021-10d7331a31",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/",
            },
            {
               name: "FEDORA-2021-2d860da728",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWZLDECIXXW3CCZ3RS4A3NG5X5VE4WZM/",
            },
            {
               name: "FEDORA-2021-96a5dabcfa",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBKWLTXM7IKZ4PVGKLUQVAVFAYGGF7QR/",
            },
            {
               name: "FEDORA-2021-be94728b95",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-8949-hhfh-j7rj",
            discovery: "UNKNOWN",
         },
         title: "Out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-29470",
      datePublished: "2021-04-23T00:00:00",
      dateReserved: "2021-03-30T00:00:00",
      dateUpdated: "2024-08-03T22:11:05.421Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-31291

Vulnerability from cvelistv5

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Show details on NVD website

JSON

To clipboard

{
   containers: {
      cna: {
         providerMetadata: {
            dateUpdated: "2021-08-06T13:15:53",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         rejectedReasons: [
            {
               lang: "en",
               value: "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2021-31291",
      datePublished: "2021-07-26T16:27:00",
      dateRejected: "2021-08-06T13:15:53",
      dateReserved: "2021-04-15T00:00:00",
      dateUpdated: "2021-08-06T13:15:53",
      state: "REJECTED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.0",
}

cve-2021-37621

Vulnerability from cvelistv5

Published

2021-08-09 00:00

Modified

2024-08-04 01:23

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p C`). The bug is fixed in version v0.27.5.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-m479-7frc-gqqg
	https://github.com/Exiv2/exiv2/pull/1778
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html	mailing-list
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: <= 0.27.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:23:01.357Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-m479-7frc-gqqg",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/1778",
               },
               {
                  name: "FEDORA-2021-399f869889",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
               },
               {
                  name: "FEDORA-2021-cbaef8e2d5",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
               },
               {
                  name: "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "<= 0.27.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p C`). The bug is fixed in version v0.27.5.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-835",
                     description: "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:53.828057",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-m479-7frc-gqqg",
            },
            {
               url: "https://github.com/Exiv2/exiv2/pull/1778",
            },
            {
               name: "FEDORA-2021-399f869889",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
            },
            {
               name: "FEDORA-2021-cbaef8e2d5",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
            },
            {
               name: "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-m479-7frc-gqqg",
            discovery: "UNKNOWN",
         },
         title: "Denial of service due to infinite loop in Image::printIFDStructure",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-37621",
      datePublished: "2021-08-09T00:00:00",
      dateReserved: "2021-07-29T00:00:00",
      dateUpdated: "2024-08-04T01:23:01.357Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-29463

Vulnerability from cvelistv5

Published

2021-04-30 00:00

Modified

2024-10-15 17:14

Severity ?

3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Summary

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-5p8g-9xf3-gfrr
	https://github.com/Exiv2/exiv2/commit/783b3a6ff15ed6f82a8f8e6c8a6f3b84a9b04d4b
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDMZTVQAZSMLPTDVDYLBHAAF7I5QXVYQ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3HKXR6JOVKMBE4HY4FDXNVZGNCQG6T3/	vendor-advisory
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: < 0.27.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T22:02:51.889Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-5p8g-9xf3-gfrr",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/commit/783b3a6ff15ed6f82a8f8e6c8a6f3b84a9b04d4b",
               },
               {
                  name: "FEDORA-2021-0b27f220bd",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDMZTVQAZSMLPTDVDYLBHAAF7I5QXVYQ/",
               },
               {
                  name: "FEDORA-2021-dde4d7d47e",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3HKXR6JOVKMBE4HY4FDXNVZGNCQG6T3/",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2021-29463",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-15T17:09:39.490416Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-15T17:14:39.960Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "< 0.27.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125 Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:42.224323",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-5p8g-9xf3-gfrr",
            },
            {
               url: "https://github.com/Exiv2/exiv2/commit/783b3a6ff15ed6f82a8f8e6c8a6f3b84a9b04d4b",
            },
            {
               name: "FEDORA-2021-0b27f220bd",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDMZTVQAZSMLPTDVDYLBHAAF7I5QXVYQ/",
            },
            {
               name: "FEDORA-2021-dde4d7d47e",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3HKXR6JOVKMBE4HY4FDXNVZGNCQG6T3/",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-5p8g-9xf3-gfrr",
            discovery: "UNKNOWN",
         },
         title: "Out-of-bounds read in Exiv2::WebPImage::doWriteMetadata",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-29463",
      datePublished: "2021-04-30T00:00:00",
      dateReserved: "2021-03-30T00:00:00",
      dateUpdated: "2024-10-15T17:14:39.960Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-37622

Vulnerability from cvelistv5

Published

2021-08-09 00:00

Modified

2024-08-04 01:23

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jh3-fcc3-g6hv
	https://github.com/Exiv2/exiv2/pull/1788
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html	mailing-list
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: <= 0.27.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:23:01.646Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jh3-fcc3-g6hv",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/1788",
               },
               {
                  name: "FEDORA-2021-399f869889",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
               },
               {
                  name: "FEDORA-2021-cbaef8e2d5",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
               },
               {
                  name: "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "<= 0.27.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-835",
                     description: "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:52.226604",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jh3-fcc3-g6hv",
            },
            {
               url: "https://github.com/Exiv2/exiv2/pull/1788",
            },
            {
               name: "FEDORA-2021-399f869889",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
            },
            {
               name: "FEDORA-2021-cbaef8e2d5",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
            },
            {
               name: "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-9jh3-fcc3-g6hv",
            discovery: "UNKNOWN",
         },
         title: "Denial of service due to infinite loop in JpegBase::printStructure (#1)",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-37622",
      datePublished: "2021-08-09T00:00:00",
      dateReserved: "2021-07-29T00:00:00",
      dateUpdated: "2024-08-04T01:23:01.646Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-29457

Vulnerability from cvelistv5

Published

2021-04-19 00:00

Modified

2024-08-03 22:02

Severity ?

Summary

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/issues/1529
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-v74w-h496-cgqm
	https://github.com/Exiv2/exiv2/pull/1534
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/	vendor-advisory
	https://www.debian.org/security/2021/dsa-4958	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html	mailing-list
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: < 0.27.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T22:02:51.923Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/issues/1529",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-v74w-h496-cgqm",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/1534",
               },
               {
                  name: "FEDORA-2021-10d7331a31",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/",
               },
               {
                  name: "FEDORA-2021-be94728b95",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/",
               },
               {
                  name: "DSA-4958",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2021/dsa-4958",
               },
               {
                  name: "[debian-lts-announce] 20210830 [SECURITY] [DLA 2750-1] exiv2 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "< 0.27.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `insert`. The bug is fixed in version v0.27.4.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-122",
                     description: "CWE-122: Heap-based Buffer Overflow",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:43.932489",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/issues/1529",
            },
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-v74w-h496-cgqm",
            },
            {
               url: "https://github.com/Exiv2/exiv2/pull/1534",
            },
            {
               name: "FEDORA-2021-10d7331a31",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/",
            },
            {
               name: "FEDORA-2021-be94728b95",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/",
            },
            {
               name: "DSA-4958",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2021/dsa-4958",
            },
            {
               name: "[debian-lts-announce] 20210830 [SECURITY] [DLA 2750-1] exiv2 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-v74w-h496-cgqm",
            discovery: "UNKNOWN",
         },
         title: "Heap buffer overflow in Exiv2::Jp2Image::doWriteMetadata",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-29457",
      datePublished: "2021-04-19T00:00:00",
      dateReserved: "2021-03-30T00:00:00",
      dateUpdated: "2024-08-03T22:02:51.923Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-37623

Vulnerability from cvelistv5

Published

2021-08-09 00:00

Modified

2024-08-04 01:23

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-mvc4-g5pv-4qqq
	https://github.com/Exiv2/exiv2/pull/1790
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/	vendor-advisory
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: <= 0.27.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:23:01.312Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-mvc4-g5pv-4qqq",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/1790",
               },
               {
                  name: "FEDORA-2021-399f869889",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
               },
               {
                  name: "FEDORA-2021-cbaef8e2d5",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "<= 0.27.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-835",
                     description: "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:21.203785",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-mvc4-g5pv-4qqq",
            },
            {
               url: "https://github.com/Exiv2/exiv2/pull/1790",
            },
            {
               name: "FEDORA-2021-399f869889",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
            },
            {
               name: "FEDORA-2021-cbaef8e2d5",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-mvc4-g5pv-4qqq",
            discovery: "UNKNOWN",
         },
         title: "Denial of service due to infinite loop in JpegBase::printStructure (#2)",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-37623",
      datePublished: "2021-08-09T00:00:00",
      dateReserved: "2021-07-29T00:00:00",
      dateUpdated: "2024-08-04T01:23:01.312Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-1000128

Vulnerability from cvelistv5

Published

2017-11-17 22:00

Modified

2024-09-16 17:28

Severity ?

Summary

Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser

References

▼	URL	Tags
	http://www.openwall.com/lists/oss-security/2017/06/30/1	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T21:53:06.900Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "[oss-security] 20170630 exiv2: multiple memory safety issues",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2017/06/30/1",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         dateAssigned: "2017-08-22T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-11-17T22:00:00Z",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "[oss-security] 20170630 exiv2: multiple memory safety issues",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2017/06/30/1",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               DATE_ASSIGNED: "2017-08-22T17:29:33.341797",
               ID: "CVE-2017-1000128",
               REQUESTER: "hanno@hboeck.de",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "[oss-security] 20170630 exiv2: multiple memory safety issues",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2017/06/30/1",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2017-1000128",
      datePublished: "2017-11-17T22:00:00Z",
      dateReserved: "2017-11-17T00:00:00Z",
      dateUpdated: "2024-09-16T17:28:41.261Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-37620

Vulnerability from cvelistv5

Published

2021-08-09 00:00

Modified

2024-08-04 01:23

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-v5g7-46xf-h728
	https://github.com/Exiv2/exiv2/pull/1769
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html	mailing-list
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: <= 0.27.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T01:23:01.285Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-v5g7-46xf-h728",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/1769",
               },
               {
                  name: "FEDORA-2021-399f869889",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
               },
               {
                  name: "FEDORA-2021-cbaef8e2d5",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
               },
               {
                  name: "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "<= 0.27.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 4.7,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:38.893138",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-v5g7-46xf-h728",
            },
            {
               url: "https://github.com/Exiv2/exiv2/pull/1769",
            },
            {
               name: "FEDORA-2021-399f869889",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
            },
            {
               name: "FEDORA-2021-cbaef8e2d5",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
            },
            {
               name: "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-v5g7-46xf-h728",
            discovery: "UNKNOWN",
         },
         title: "Out-of-bounds read in XmpTextValue::read()",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-37620",
      datePublished: "2021-08-09T00:00:00",
      dateReserved: "2021-07-29T00:00:00",
      dateUpdated: "2024-08-04T01:23:01.285Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-13111

Vulnerability from cvelistv5

Published

2019-06-30 22:20

Modified

2024-08-04 23:41

Severity ?

Summary

A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/issues/791	x_refsource_MISC
	https://github.com/Exiv2/exiv2/pull/797	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T23:41:10.408Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/issues/791",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/797",
               },
               {
                  name: "FEDORA-2019-60553d5a18",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-08-09T02:06:05",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/Exiv2/exiv2/issues/791",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/Exiv2/exiv2/pull/797",
            },
            {
               name: "FEDORA-2019-60553d5a18",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2019-13111",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very long running loop) via a crafted WEBP image file.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/Exiv2/exiv2/issues/791",
                     refsource: "MISC",
                     url: "https://github.com/Exiv2/exiv2/issues/791",
                  },
                  {
                     name: "https://github.com/Exiv2/exiv2/pull/797",
                     refsource: "MISC",
                     url: "https://github.com/Exiv2/exiv2/pull/797",
                  },
                  {
                     name: "FEDORA-2019-60553d5a18",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGBT5OD2TF4AIXJUC56WOUJRHAZLZ4DC/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2019-13111",
      datePublished: "2019-06-30T22:20:54",
      dateReserved: "2019-06-30T00:00:00",
      dateUpdated: "2024-08-04T23:41:10.408Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-32617

Vulnerability from cvelistv5

Published

2021-05-17 00:00

Modified

2024-08-03 23:25

Severity ?

4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `rm`.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj
	https://github.com/Exiv2/exiv2/pull/1657
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/	vendor-advisory
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: <= 0.27.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T23:25:30.946Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/1657",
               },
               {
                  name: "FEDORA-2021-d1d5a0bf0f",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/",
               },
               {
                  name: "FEDORA-2021-8253c78bd7",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/",
               },
               {
                  name: "FEDORA-2021-bdba47348c",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/",
               },
               {
                  name: "FEDORA-2021-8917c5d9d2",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "<= 0.27.3",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2 operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `rm`.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 4.7,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400: Uncontrolled Resource Consumption",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:31.177527",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-w8mv-g8qq-36mj",
            },
            {
               url: "https://github.com/Exiv2/exiv2/pull/1657",
            },
            {
               name: "FEDORA-2021-d1d5a0bf0f",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/",
            },
            {
               name: "FEDORA-2021-8253c78bd7",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/",
            },
            {
               name: "FEDORA-2021-bdba47348c",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/",
            },
            {
               name: "FEDORA-2021-8917c5d9d2",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-w8mv-g8qq-36mj",
            discovery: "UNKNOWN",
         },
         title: "Denial of service in Exiv2",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-32617",
      datePublished: "2021-05-17T00:00:00",
      dateReserved: "2021-05-12T00:00:00",
      dateUpdated: "2024-08-03T23:25:30.946Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-29623

Vulnerability from cvelistv5

Published

2021-05-13 00:00

Modified

2024-08-03 22:11

Severity ?

3.6 (Low) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Summary

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v
	https://github.com/Exiv2/exiv2/pull/1627
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/	vendor-advisory
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: < v0.27.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T22:11:06.285Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/1627",
               },
               {
                  name: "FEDORA-2021-d1d5a0bf0f",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/",
               },
               {
                  name: "FEDORA-2021-8253c78bd7",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/",
               },
               {
                  name: "FEDORA-2021-bdba47348c",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/",
               },
               {
                  name: "FEDORA-2021-8917c5d9d2",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "< v0.27.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.6,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-908",
                     description: "{\"CWE-908\":\"Use of Uninitialized Resource\"}",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:22.858253",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v",
            },
            {
               url: "https://github.com/Exiv2/exiv2/pull/1627",
            },
            {
               name: "FEDORA-2021-d1d5a0bf0f",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G/",
            },
            {
               name: "FEDORA-2021-8253c78bd7",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2BPQNJKTRIDINTVJ22QMMTIZEPHVKXK/",
            },
            {
               name: "FEDORA-2021-bdba47348c",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQAKFIQHW2AS3AGSJM42ABOA6CWIJBGM/",
            },
            {
               name: "FEDORA-2021-8917c5d9d2",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZ5SGWHK64TB7ADRSVBGHEPDFN5CSOO3/",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-6253-qjwm-3q4v",
            discovery: "UNKNOWN",
         },
         title: "Uninitialized variable bug in Exiv2",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-29623",
      datePublished: "2021-05-13T00:00:00",
      dateReserved: "2021-03-30T00:00:00",
      dateUpdated: "2024-08-03T22:11:06.285Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-34334

Vulnerability from cvelistv5

Published

2021-08-09 00:00

Modified

2024-08-04 00:05

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.

References

▼	URL	Tags
	https://github.com/Exiv2/exiv2/security/advisories/GHSA-hqjh-hpv8-8r9p
	https://github.com/Exiv2/exiv2/pull/1766
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html	mailing-list
	https://security.gentoo.org/glsa/202312-06	vendor-advisory

Impacted products

	Vendor	Product	Version
	Exiv2	exiv2	Version: <= 0.27.4

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T00:05:52.788Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-hqjh-hpv8-8r9p",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Exiv2/exiv2/pull/1766",
               },
               {
                  name: "FEDORA-2021-399f869889",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
               },
               {
                  name: "FEDORA-2021-cbaef8e2d5",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
               },
               {
                  name: "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html",
               },
               {
                  name: "GLSA-202312-06",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-06",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "exiv2",
               vendor: "Exiv2",
               versions: [
                  {
                     status: "affected",
                     version: "<= 0.27.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-835",
                     description: "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T10:06:45.645758",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/Exiv2/exiv2/security/advisories/GHSA-hqjh-hpv8-8r9p",
            },
            {
               url: "https://github.com/Exiv2/exiv2/pull/1766",
            },
            {
               name: "FEDORA-2021-399f869889",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/",
            },
            {
               name: "FEDORA-2021-cbaef8e2d5",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/",
            },
            {
               name: "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html",
            },
            {
               name: "GLSA-202312-06",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-06",
            },
         ],
         source: {
            advisory: "GHSA-hqjh-hpv8-8r9p",
            discovery: "UNKNOWN",
         },
         title: "Denial of service due to integer overflow in loop counter",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2021-34334",
      datePublished: "2021-08-09T00:00:00",
      dateReserved: "2021-06-08T00:00:00",
      dateUpdated: "2024-08-04T00:05:52.788Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature