PT-2021-6516 · Exiv2+4 · Exiv2+4

Kevinbackhouse · Published 2021-08-09 · Updated 2025-01-10 · CVE-2021-34335

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description The issue is related to a lack of division by zero check in the Exiv2 library, which can cause a denial of service when a specially crafted image file is used. An attacker could exploit this to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is triggered when printing the interpreted data, which requires an extra command line option (-p t or -P t).

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the -p t or -P t command line options to minimize the risk of exploitation. Restrict access to crafted image files to prevent potential denial of service attacks.

Fix

DoS

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

ALT-PU-2021-3110

ALT-PU-2021-3499

ALT-PU-2024-13399

AZL-7216

BDU:2022-01776

CVE-2021-34335

GHSA-PVJP-M4F6-Q984

MGASA-2021-0415

OESA-2021-1451

OESA-2022-1955

OESA-2022-2044

OPENSUSE-SU-2024:12507-1

USN-5043-1

Affected Products

Alt Linux

Exiv2

Linuxmint

Red Os

Ubuntu

References · 60

• https://github.com/Exiv2/exiv2/pull/1750 · Patch
• https://osv.dev/vulnerability/OESA-2021-1451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34334 · Security Note
• https://ubuntu.com/security/CVE-2021-37616 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37620 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37615 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37615 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37621 · Security Note
• https://ubuntu.com/security/CVE-2021-32815 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-34335 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01776 · Security Note
• https://ubuntu.com/security/CVE-2021-37618 · Vendor Advisory