CVE-2024-39695

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 version v0.28.2. The vulnerability is in the parser for the ASF video format, which was a new feature in v0.28.0. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted video file. The bug is fixed in version v0.28.3.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-396968.1Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account CVE-2024-396978.6phonenumber is a library for parsing, formatting and validating international phone numbers. Since 0.3.4, the phonenumber parsing code may p CVE-2024-396987.5electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerif CVE-2024-396995.0Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file im CVE-2024-39707.5Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disc CVE-2024-397009.8JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option CVE-2024-397017.7Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin o CVE-2024-397025.9In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Den CVE-2024-397038.8In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API e CVE-2024-397049.8Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary code CVE-2024-397059.8NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download fun CVE-2024-397075.3Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could le