PT-2021-7925 · Exiv2+9 · Exiv2+9

Published 2021-08-08 · Updated 2025-01-10 · CVE-2021-37619

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description The issue is related to an out-of-bounds read in Exiv2, which can be triggered when the utility is used to write metadata into a crafted image file. This could potentially allow an attacker to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, a less frequently used operation than reading metadata. For instance, to trigger the bug in the Exiv2 command-line application, an extra command-line argument such as insert is needed.

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of Exiv2 to write metadata into image files until the update is applied. Restricting the use of Exiv2 for metadata writing operations can help minimize the risk of exploitation.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALSA-2021:4173

ALSA-2021:4319

ALT-PU-2021-3110

ALT-PU-2021-3499

ALT-PU-2024-13399

AZL-7221

BDU:2023-05486

CESA-2021_4173

CESA-2021_4319

CVE-2021-37619

GHSA-MXW9-QX4C-6M8V

MGASA-2021-0415

OESA-2021-1451

OESA-2022-2044

OPENSUSE-SU-2022_3598-1

RHSA-2021:4173

RHSA-2021:4319

RHSA-2021_4173

RHSA-2021_4319

RLSA-2021:4173

RLSA-2021:4319

SUSE-SU-2022:3598-1

USN-5043-1

Affected Products

Alt Linux

Almalinux

Centos

Exiv2

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 119

• https://github.com/Exiv2/exiv2/pull/1752 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-37619 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34335 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37619 · Security Note
• https://ubuntu.com/security/CVE-2021-37616 · Vendor Advisory
• https://security.gentoo.org/glsa/202312-06 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37618 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4319 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37619 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-37619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37623 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-32815 · Security Note
• https://ubuntu.com/security/notices/USN-5043-1 · Vendor Advisory