VDB
CVE-2021-29623
CVE-2021-29623
PUBLISHED
CVSS 3.5999999046325684 LOW
Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4.
EPSS 1.10% · 63.8th percentile
Risk Scores
CVSS 3.1
3.5999999046325684
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Score
1.10%
63.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:20.04:LTS | exiv2 | 0, 0.25-4ubuntu2, 0.25-4ubuntu3 |
Timeline
- May 13, 2021 CVE Published
- May 14, 2021 EPSS Score
- Jun 2, 2021 EPSS Score
- Jun 8, 2021 EPSS Score
- Jul 17, 2021 EPSS Score
- Sep 17, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 19, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 23, 2022 EPSS Score
- Jul 25, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2021-29623 third-party-advisory
- https://github.com/Exiv2/exiv2/pull/1627 third-party-advisory
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-6253-qjwm-3q4v third-party-advisory
- https://ubuntu.com/security/notices/USN-4964-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-29623 third-party-advisory