Advisories » MGASA-2026-0379

Updated exiv2 package fixes security vulnerabilities

Publication date: 07 Sep 2026
Modification date: 07 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-68546 , CVE-2026-68547 , CVE-2026-49275

Description

Heap out-of-bounds write in RemoteIo when reading from a malicious
remote server (WebReady/Curl builds). (CVE-2026-68546)
Heap out-of-bounds read in RemoteIo when reading block-aligned remote
CRW files. (CVE-2026-68547)
Out of bounds read in CrwMap::decodeBasic. (CVE-2026-49275)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36221
• https://www.openwall.com/lists/oss-security/2026/08/30/1
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
• https://github.com/Exiv2/exiv2/security/advisories/GHSA-pwvq-9w4q-786w
• https://www.cve.org/CVERecord?id=CVE-2026-68546
• https://www.cve.org/CVERecord?id=CVE-2026-68547
• https://www.cve.org/CVERecord?id=CVE-2026-49275

SRPMS

10/core

• exiv2-0.28.9-1.mga10