Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-39695 Details

Description

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/Exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387 CVEPatch
https://github.com/Exiv2/exiv2/pull/3006 CVEIssue TrackingPatch
https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh CVEVendor Advisory
https://github.com/Exiv2/exiv2/commit/3a28346db5ae1735a8728fe3491b0aecc1dbf387 [email protected]Patch
https://github.com/Exiv2/exiv2/pull/3006 [email protected]Issue TrackingPatch

see all 6 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-125Out-of-bounds Read[email protected]
CWE-125Out-of-bounds Read[email protected]

Affected Products

ProductVersions
exiv2 exiv2
>= 0.28.0, < 0.28.3

CPE

  • cpe:2.3:a:exiv2:exiv2:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-39695
NVD Published Date:
Jul 8, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2024-39695 Details - Not Deferred