2021-37619 | Exiv2 Command-Line Argument out-of-bounds read
|CVSS Meta Temp Score||Current Exploit Price (≈)||CTI Interest Score|
A vulnerability was found in Exiv2 up to 0.27.4 (Image Processing Software). It has been rated as problematic. Affected by this issue is an unknown code of the component Command-Line Argument Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-125. Impacted is confidentiality, and availability. CVE summarizes:
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.5.
The weakness was disclosed 08/10/2021. The advisory is available at github.com. This vulnerability is handled as CVE-2021-37619 since 07/29/2021. The exploitation is known to be difficult. The attack may be launched remotely. A simple authentication is needed for exploitation. The technical details are unknown and an exploit is not available.
Upgrading to version 0.27.5 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
VulDB Meta Base Score: 3.1
VulDB Meta Temp Score: 3.0
Status: Not defined
0-Day Time: 🔒
Download the whitepaper to learn more about our service!