CVE-2021-34334 — Vulnetix

Try Vulnetix Request Demo

CVE-2021-34334 PUBLISHED

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.

EPSS 0.11% · 29.7th percentile

Risk Scores

EPSS Score

0.11%

29.7th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:20.04:LTS	exiv2	0, 0.27.2-8ubuntu2.5, 0.27.2-8ubuntu2.4
Ubuntu:18.04:LTS	exiv2	0.25-3.1ubuntu0.18.04.1, 0, 0.25-3.1
Ubuntu:22.04:LTS	exiv2	0
Ubuntu:Pro:16.04:LTS	exiv2	0.25-2.1ubuntu16.04.2, 0.25-2.1ubuntu16.04.1, 0.25-2.1

Timeline

Aug 9, 2021 CVE Published
Aug 10, 2021 EPSS Score
Aug 20, 2021 EPSS Score
Oct 7, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Jan 31, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Mar 31, 2022 EPSS Score
Apr 1, 2022 EPSS Score
May 28, 2022 EPSS Score
Sep 22, 2022 EPSS Score
Nov 19, 2022 EPSS Score

References

https://ubuntu.com/security/CVE-2021-34334 third-party-advisory
https://github.com/Exiv2/exiv2/security/advisories/GHSA-hqjh-hpv8-8r9p third-party-advisory
https://github.com/Exiv2/exiv2/pull/1766 third-party-advisory
https://ubuntu.com/security/notices/USN-5043-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2021-34334 third-party-advisory

Open in Interactive Console →