UBUNTU-CVE-2021-32617

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2021-32617
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-32617.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-32617
Related
Published
2021-05-17T18:15:00Z
Modified
2021-05-17T18:15:00Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as rm.

References

Affected packages

Ubuntu:Pro:16.04:LTS / exiv2

Package

Name
exiv2
Purl
pkg:deb/ubuntu/exiv2?arch=src?distro=esm-infra/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.25-2.1ubuntu16.04.7+esm2

Affected versions

0.*

0.25-1ubuntu1
0.25-2.1
0.25-2.1ubuntu16.04.1
0.25-2.1ubuntu16.04.2
0.25-2.1ubuntu16.04.3
0.25-2.1ubuntu16.04.4
0.25-2.1ubuntu16.04.5
0.25-2.1ubuntu16.04.6
0.25-2.1ubuntu16.04.7+esm1

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "0.25-2.1ubuntu16.04.7+esm2",
            "binary_name": "exiv2"
        },
        {
            "binary_version": "0.25-2.1ubuntu16.04.7+esm2",
            "binary_name": "exiv2-dbgsym"
        },
        {
            "binary_version": "0.25-2.1ubuntu16.04.7+esm2",
            "binary_name": "libexiv2-14"
        },
        {
            "binary_version": "0.25-2.1ubuntu16.04.7+esm2",
            "binary_name": "libexiv2-14-dbgsym"
        },
        {
            "binary_version": "0.25-2.1ubuntu16.04.7+esm2",
            "binary_name": "libexiv2-dbg"
        },
        {
            "binary_version": "0.25-2.1ubuntu16.04.7+esm2",
            "binary_name": "libexiv2-dev"
        },
        {
            "binary_version": "0.25-2.1ubuntu16.04.7+esm2",
            "binary_name": "libexiv2-dev-dbgsym"
        },
        {
            "binary_version": "0.25-2.1ubuntu16.04.7+esm2",
            "binary_name": "libexiv2-doc"
        }
    ]
}

Ubuntu:18.04:LTS / exiv2

Package

Name
exiv2
Purl
pkg:deb/ubuntu/exiv2?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.25-3.1ubuntu0.18.04.9

Affected versions

0.*

0.25-3.1
0.25-3.1ubuntu0.18.04.1
0.25-3.1ubuntu0.18.04.2
0.25-3.1ubuntu0.18.04.3
0.25-3.1ubuntu0.18.04.4
0.25-3.1ubuntu0.18.04.5
0.25-3.1ubuntu0.18.04.7

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "0.25-3.1ubuntu0.18.04.9",
            "binary_name": "exiv2"
        },
        {
            "binary_version": "0.25-3.1ubuntu0.18.04.9",
            "binary_name": "libexiv2-14"
        },
        {
            "binary_version": "0.25-3.1ubuntu0.18.04.9",
            "binary_name": "libexiv2-dbg"
        },
        {
            "binary_version": "0.25-3.1ubuntu0.18.04.9",
            "binary_name": "libexiv2-dev"
        },
        {
            "binary_version": "0.25-3.1ubuntu0.18.04.9",
            "binary_name": "libexiv2-doc"
        }
    ]
}

Ubuntu:20.04:LTS / exiv2

Package

Name
exiv2
Purl
pkg:deb/ubuntu/exiv2?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.27.2-8ubuntu2.4

Affected versions

0.*

0.25-4ubuntu2
0.25-4ubuntu3
0.27.2-8ubuntu2
0.27.2-8ubuntu2.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "0.27.2-8ubuntu2.4",
            "binary_name": "exiv2"
        },
        {
            "binary_version": "0.27.2-8ubuntu2.4",
            "binary_name": "exiv2-dbgsym"
        },
        {
            "binary_version": "0.27.2-8ubuntu2.4",
            "binary_name": "libexiv2-27"
        },
        {
            "binary_version": "0.27.2-8ubuntu2.4",
            "binary_name": "libexiv2-27-dbgsym"
        },
        {
            "binary_version": "0.27.2-8ubuntu2.4",
            "binary_name": "libexiv2-dev"
        },
        {
            "binary_version": "0.27.2-8ubuntu2.4",
            "binary_name": "libexiv2-doc"
        }
    ]
}