PT-2021-8244 · Exiv2+8 · Exiv2+8
Lowkevinbackhouse
·
Published
2021-04-20
·
Updated
2025-01-10
·
CVE-2021-29464
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Exiv2 versions v0.27.3 and earlier
Description
A heap buffer overflow was found in Exiv2 when used to write metadata into a crafted image file. This could potentially allow an attacker to gain code execution if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, which is a less frequently used operation than reading metadata. For example, to trigger the bug in the Exiv2 command-line application, an extra command-line argument such as
insert is needed.Recommendations
For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the use of the
insert command-line argument or any other operation that triggers metadata writing until the update is applied. Restrict access to potentially crafted image files to minimize the risk of exploitation.Fix
Memory Corruption
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Exiv2
Linuxmint
Red Hat
Red Os
Rocky Linux
Ubuntu