VDB
CVE-2021-29623
CVE-2021-29623
PUBLISHED
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4.
EPSS 0.31% · 54.1th percentile
Risk Scores
EPSS Score
0.31%
54.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:20.04:LTS | exiv2 | 0, 0.25-4ubuntu2, 0.25-4ubuntu3 |
Timeline
- May 13, 2021 CVE Published
- May 14, 2021 EPSS Score
- Jun 2, 2021 EPSS Score
- Jun 8, 2021 EPSS Score
- Jul 17, 2021 EPSS Score
- Sep 16, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 17, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 20, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 22, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2021-29623 third-party-advisory
- https://github.com/Exiv2/exiv2/pull/1627 third-party-advisory
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v third-party-advisory
- https://ubuntu.com/security/notices/USN-4964-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-29623 third-party-advisory