PT-2021-7927 · Exiv2+4 · Exiv2+4

Kevinbackhouse · Published 2021-08-09 · Updated 2025-01-10 · CVE-2021-37616

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description A null pointer dereference was found in Exiv2, which can be triggered when printing the metadata of a crafted image file. This can potentially be exploited by an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when printing the interpreted (translated) data, which requires an extra command line option (-p t or -P t).

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the -p t or -P t command line options to minimize the risk of exploitation.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2021-3110

ALT-PU-2021-3499

ALT-PU-2024-13399

AZL-7219

BDU:2023-05488

CVE-2021-37616

GHSA-54F7-VVJ7-545W

MGASA-2021-0415

OESA-2021-1451

OESA-2022-1955

OESA-2022-2044

USN-5043-1

Affected Products

Alt Linux

Exiv2

Linuxmint

Red Os

Ubuntu

References · 57

• https://github.com/Exiv2/exiv2/pull/1758 · Patch
• https://osv.dev/vulnerability/OESA-2021-1451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34334 · Security Note
• https://ubuntu.com/security/CVE-2021-37616 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37620 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37615 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37616 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37615 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37621 · Security Note
• https://ubuntu.com/security/CVE-2021-32815 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37618 · Vendor Advisory