diff --git a/.github/workflows/exiv2.org.yml b/.github/workflows/exiv2.org.yml index ff4a582e..ab30aa0a 100644 --- a/.github/workflows/exiv2.org.yml +++ b/.github/workflows/exiv2.org.yml @@ -13,7 +13,7 @@ jobs: deploy: strategy: matrix: - EXIV2TAG: [v0.28.8] + EXIV2TAG: [v0.28.9] runs-on: ubuntu-24.04 concurrency: group: ${{ github.workflow }}-${{ github.ref }} diff --git a/website/master/news.xml b/website/master/news.xml index 53a0acc5..0047ec03 100644 --- a/website/master/news.xml +++ b/website/master/news.xml @@ -1,6 +1,25 @@ + + 2026-08-30 + Exiv2 v0.28.9 + Exiv2 v0.28.9 + +
    +
  1. Security fixes
    2. +
  2. Out-of-bounds write in RemoteIo::Impl::populateBlocks() (moderate severity, CVE-2026-68546)
    3. +
  3. Out-of-bounds read in RemoteIo::Impl::populateBlocks() (low severity, CVE-2026-68547)
    4. +
  4. Out-of-bounds read in CrwMap::decodeBasic() (low severity, CVE-2026-49275)
    5. +
  5. Out-of-bounds write in RemoteIo::mmap() (low severity, CVE requested)
    6. +
  6. Out-of-bounds write in Exiv2::http() (low severity, CVE requested)
    7. +
  7. Denial of service in QuickTimeVideo::userDataDecoder() (low severity, CVE requested)
    8. +
  8. Denial of service in PgfImage::readMetadata() (low severity, CVE requested)
    9. +
+

More details: Change List

+ + + 2026-03-01 Exiv2 v0.28.8