PT-2021-7922 · Exiv2 +9 · Exiv2 +9

Yuawn · Published 2021-05-13 · Updated 2025-01-17 · CVE-2021-29623

Positive Technologies · (AI Summary)

CVSS v2.0

4.3

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

Exiv2 versions v0.27.3 and earlier

Description:

A read of uninitialized memory was found in Exiv2, which is triggered when the utility is used to read the metadata of a crafted image file. This could potentially allow an attacker to leak a few bytes of stack memory if they can trick the victim into running Exiv2 on a crafted image file. The vulnerability is related to the use of an uninitialized resource and may allow an attacker to gain unauthorized access to protected information.

Recommendations:

For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the use of Exiv2 to read metadata from untrusted image files until the update is applied.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

ALSA-2021:4173

ALT-PU-2021-2006

ALT-PU-2024-13399

BDU:2023-05479

CESA-2021_4173

CVE-2021-29623

GHSA-6253-QJWM-3Q4V

MGASA-2021-0240

OPENSUSE-SU-2022_3889-1

OPENSUSE-SU-2024:12063-1

RHSA-2021:4173

RHSA-2021_4173

RLSA-2021:4173

SUSE-SU-2022:3889-1

USN-4964-1

Affected Products

Alt Linux

Almalinux

Centos

Exiv2

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 177

• https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v · Patch
• https://github.com/Exiv2/exiv2/pull/1627 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-29623 · Vendor Advisory
• https://security.gentoo.org/glsa/202312-06 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01777 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37620 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29458 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37623 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/5I3RRZUGSBIUYZ5TIHLN55PKMAWCSJ5G · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29623 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01673 · Security Note
• https://ubuntu.com/security/CVE-2021-29473 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-29463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29623 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-29623 · Security Note