CVE-2021-32617

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2021-32617

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32617.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-32617

Aliases

GHSA-w8mv-g8qq-36mj

Related

Published

2021-05-17T18:15:08Z

Modified

2024-09-18T03:27:15.066230Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as rm.

References

Affected packages

Debian:11 / exiv2

Package

Name: exiv2
Purl: pkg:deb/debian/exiv2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.27.3-3

0.27.3-3+deb11u1

0.27.3-3+deb11u2

0.27.3-3.1

0.27.5-1

0.27.5-2

0.27.5-3

0.27.5-4

0.27.6-1

0.28.0+dfsg-1

0.28.0+dfsg-2

0.28.0+dfsg-3

0.28.0+dfsg-4

0.28.1+dfsg-1

0.28.1+dfsg-2

0.28.1+dfsg-3

0.28.2+dfsg-1

0.28.3+dfsg-1

0.28.3+dfsg-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / exiv2

Package

Name: exiv2
Purl: pkg:deb/debian/exiv2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.27.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / exiv2

Package

Name: exiv2
Purl: pkg:deb/debian/exiv2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.27.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}