PT-2021-4573 · Exiv2+10 · Exiv2+10
Kevinbackhouse
·
Published
2021-04-23
·
Updated
2025-01-10
·
CVE-2021-29473
CVSS v2.0
2.6
Low
| Vector | AV:N/AC:H/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Exiv2 versions v0.27.3 and earlier
Description
An out-of-bounds read was found in Exiv2, triggered when it is used to write metadata into a crafted image file. This could potentially allow an attacker to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, which is a less frequently used operation than reading metadata. For example, to trigger the bug in the Exiv2 command-line application, an extra command-line argument such as
insert is needed.Recommendations
For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the use of the
insert command-line argument when running the Exiv2 command-line application on untrusted image files. Restrict access to writing metadata to minimize the risk of exploitation.Exploit
Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Exiv2
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu