CVE-2021-34334

Name
CVE-2021-34334
Description
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/Exiv2/exiv2/pull/1766
CONFIRM https://github.com/Exiv2/exiv2/security/advisories/GHSA-hqjh-hpv8-8r9p
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:exiv2:exiv2:*:*:*:*:*:*:*:* exiv2 >= None <= 0.27.4

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
exiv2 3.11-main 0.27.2-r3 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
exiv2 3.14-community 0.27.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
exiv2 3.15-community 0.27.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed