{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"Critical" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"exiv2 security update", "category":"general", "title":"Synopsis" }, { "text":"An update for exiv2 is now available for openEuler-24.03-LTS-SP1", "category":"general", "title":"Summary" }, { "text":"Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata. It provides fast and easy read and write access to the Exif, IPTC and XMP metadata and the ICC Profile embedded within digital images in various formats.\n\nSecurity Fix(es):\n\nExiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).(CVE-2026-49275)\n\nExiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.(CVE-2026-68546)\n\nExiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.(CVE-2026-68547)", "category":"general", "title":"Description" }, { "text":"An update for exiv2 is now available for openEuler-24.03-LTS-SP1.\n\nopenEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"Critical", "category":"general", "title":"Severity" }, { "text":"exiv2", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-3890", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3890" }, { "summary":"CVE-2026-49275", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-49275&packageName=exiv2" }, { "summary":"CVE-2026-68546", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-68546&packageName=exiv2" }, { "summary":"CVE-2026-68547", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-68547&packageName=exiv2" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49275" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68546" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68547" }, { "summary":"openEuler-SA-2026-3890 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-3890.json" } ], "title":"An update for exiv2 is now available for openEuler-24.03-LTS-SP1", "tracking":{ "initial_release_date":"2026-09-21T15:03:12+08:00", "revision_history":[ { "date":"2026-09-21T15:03:12+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-09-21T15:03:12+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-09-21T15:03:12+08:00", "id":"openEuler-SA-2026-3890", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"openEuler-24.03-LTS-SP1", "name":"openEuler-24.03-LTS-SP1" }, "name":"openEuler-24.03-LTS-SP1", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-0.28.2-10.oe2403sp1.aarch64.rpm", "name":"exiv2-0.28.2-10.oe2403sp1.aarch64.rpm" }, "name":"exiv2-0.28.2-10.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64.rpm", "name":"exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64.rpm" }, "name":"exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64.rpm", "name":"exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64.rpm" }, "name":"exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-devel-0.28.2-10.oe2403sp1.aarch64.rpm", "name":"exiv2-devel-0.28.2-10.oe2403sp1.aarch64.rpm" }, "name":"exiv2-devel-0.28.2-10.oe2403sp1.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-0.28.2-10.oe2403sp1.src.rpm", "name":"exiv2-0.28.2-10.oe2403sp1.src.rpm" }, "name":"exiv2-0.28.2-10.oe2403sp1.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-0.28.2-10.oe2403sp1.x86_64.rpm", "name":"exiv2-0.28.2-10.oe2403sp1.x86_64.rpm" }, "name":"exiv2-0.28.2-10.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64.rpm", "name":"exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64.rpm" }, "name":"exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64.rpm", "name":"exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64.rpm" }, "name":"exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-devel-0.28.2-10.oe2403sp1.x86_64.rpm", "name":"exiv2-devel-0.28.2-10.oe2403sp1.x86_64.rpm" }, "name":"exiv2-devel-0.28.2-10.oe2403sp1.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"noarch", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"exiv2-help-0.28.2-10.oe2403sp1.noarch.rpm", "name":"exiv2-help-0.28.2-10.oe2403sp1.noarch.rpm" }, "name":"exiv2-help-0.28.2-10.oe2403sp1.noarch.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-0.28.2-10.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "name":"exiv2-0.28.2-10.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "name":"exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "name":"exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-devel-0.28.2-10.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "name":"exiv2-devel-0.28.2-10.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-0.28.2-10.oe2403sp1.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "name":"exiv2-0.28.2-10.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-0.28.2-10.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "name":"exiv2-0.28.2-10.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "name":"exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "name":"exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-devel-0.28.2-10.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "name":"exiv2-devel-0.28.2-10.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"exiv2-help-0.28.2-10.oe2403sp1.noarch.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch", "name":"exiv2-help-0.28.2-10.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-49275", "notes":[ { "text":"Exiv2 has an out-of-bounds read vulnerability in the CrwMap::decodeBasic() function in versions 0.28.8 and earlier. This vulnerability was discovered by OSS-Fuzz and can be reproduced through the fuzz testing target, but currently cannot be reproduced through the exiv2 command line application. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432405).", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch" ], "details":"exiv2 security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3890" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.2, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-49275" }, { "cve":"CVE-2026-68546", "notes":[ { "text":"Exiv2 discovered a heap out-of-bounds write vulnerability in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. This vulnerability only affects WebReady or Exiv2 binaries built with Curl. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432403). Reported by zenniskayy2k4.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch" ], "details":"exiv2 security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3890" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-68546" }, { "cve":"CVE-2026-68547", "notes":[ { "text":"Exiv2 discovered a heap out-of-bounds read vulnerability (off-by-one) in the RemoteIo::Impl::populateBlocks() function in versions 0.28.8 and earlier. The vulnerability is located in the RemoteIo class and is only triggered when Exiv2 handles a remote resource through a URL (not a local file), such as exiv2 https://dodgywebsite.com/poc.jpg. The root cause is related to reading a block-aligned remote CRW file. The affected Snyk trace is the exiv2 package in the Alpine 3.24 release (SNYK-ALPINE324-EXIV2-19432401). Reported by Mmandysa.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch" ], "details":"exiv2 security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3890" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.2, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.src", "openEuler-24.03-LTS-SP1:exiv2-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debuginfo-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-debugsource-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-devel-0.28.2-10.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:exiv2-help-0.28.2-10.oe2403sp1.noarch" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-68547" } ] }