CVE-2021-31292: Buffer Overflow
An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/exiv2to a version that resolves this vulnerability.Fixed in 0.25-4+deb10u2Fixed in 0.25-4+deb10u4Fixed in 0.27.3-3+deb11u2Fixed in 0.27.3-3+deb11u1Fixed in 0.27.6-1 - Upgrade
Upgrade
redhat/exiv2to a version that resolves this vulnerability.Fixed in 0.27.4
Event History
Frequently Asked Questions
What is the severity of CVE-2021-31292?
The severity of CVE-2021-31292 is high with a CVSS score of 7.5.
How can attackers exploit CVE-2021-31292?
Attackers can trigger a heap-based buffer overflow and cause a denial of service by exploiting the integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3.
What software versions are affected by CVE-2021-31292?
Exiv2 versions 0.25-4+deb10u2, 0.25-4+deb10u4, 0.27.3-3+deb11u2, 0.27.3-3+deb11u1, and 0.27.6-1 are affected by CVE-2021-31292.
Where can I find more information about CVE-2021-31292?
You can find more information about CVE-2021-31292 on the GitHub pages and the Debian security tracker provided in the references.