PT-2021-7718 · Exiv2+6 · Exiv2+6

Kevin Backhouse · Published 2021-07-11 · Updated 2025-01-10 · CVE-2021-37620

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description The issue is related to an out-of-bounds read in the Exiv2 library, which can be triggered when reading the metadata of a specially crafted image file. This could potentially allow a remote attacker to cause a denial of service. The library is used for managing metadata of image files.

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2021-3110

ALT-PU-2021-3499

ALT-PU-2024-13399

AZL-7222

BDU:2023-01704

CVE-2021-37620

DLA-3265-1

GHSA-V5G7-46XF-H728

MGASA-2021-0415

OESA-2021-1451

OESA-2022-1955

OESA-2022-2044

OPENSUSE-SU-2022_3598-1

OPENSUSE-SU-2022_3889-1

OPENSUSE-SU-2024:12381-1

SUSE-SU-2022:3598-1

SUSE-SU-2022:3889-1

SUSE-SU-2022:4252-1

USN-5043-1

USN-5043-2

Affected Products

Alt Linux

Astra Linux

Exiv2

Linuxmint

Red Os

Suse

Ubuntu

References · 131

• https://github.com/Exiv2/exiv2/pull/1769 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-37620 · Security Note
• https://ubuntu.com/security/CVE-2021-37616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37620 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37621 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1955 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37622 · Security Note
• https://advisories.mageia.org/MGASA-2021-0415.html · Security Note
• https://ubuntu.com/security/CVE-2021-37623 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5043-2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12381-1 · Vendor Advisory