| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 3.0 | $0-$5k | 0.20 |
A vulnerability was found in Exiv2 up to 0.27.4 (Image Processing Software). It has been rated as problematic. Affected by this issue is an unknown code of the component Command-Line Argument Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-125. Impacted is confidentiality, and availability. CVE summarizes:
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.5.
The weakness was disclosed 08/10/2021. The advisory is available at github.com. This vulnerability is handled as CVE-2021-37619 since 07/29/2021. The exploitation is known to be difficult. The attack may be launched remotely. A simple authentication is needed for exploitation. The technical details are unknown and an exploit is not available.
Upgrading to version 0.27.5 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
Type
Name
VulDB Meta Base Score: 3.1
VulDB Meta Temp Score: 3.0
VulDB Base Score: 3.1
VulDB Temp Score: 3.0
VulDB Vector: 🔒
VulDB Reliability: 🔍
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 🔍 | 🔍 | 🔍 | 🔍 | 🔍 | 🔍 |
| 🔍 | 🔍 | 🔍 | 🔍 | 🔍 | 🔍 |
| 🔍 | 🔍 | 🔍 | 🔍 | 🔍 | 🔍 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Information disclosure
CWE: CWE-125
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | unlock | unlock | unlock | unlock |
|---|---|---|---|---|
| Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍Recommended: Upgrade
Status: 🔍
0-Day Time: 🔒
Upgrade: Exiv2 0.27.5
Patch: github.com
07/29/2021 CVE assigned
08/10/2021 Advisory disclosed
08/10/2021 VulDB entry created
08/14/2021 VulDB last updateAdvisory: github.com
Status: Confirmed
Confirmation: 🔒
CVE: CVE-2021-37619 (🔒)
Created: 08/10/2021 10:43
Updated: 08/14/2021 18:27
Changes: (1) source_cve_cna
Complete: 🔍
Download the whitepaper to learn more about our service!
