CVE-2021-3482: Buffer Overflow
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.
Other sources
A flaw was found in Exiv2. An improper check of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow.
Reference: https://github.com/Exiv2/exiv2/issues/1522
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/exiv2to a version that resolves this vulnerability.Fixed in 0.25-4+deb10u2Fixed in 0.25-4+deb10u4Fixed in 0.27.3-3+deb11u2Fixed in 0.27.6-1 - Upgrade
Upgrade
redhat/exiv2to a version that resolves this vulnerability.Fixed in 0.27.4 - Upgrade
Upgrade
exiv2to a version that resolves this vulnerability.Fixed in 0.27.4-RC1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3482?
CVE-2021-3482 is considered a high-severity vulnerability due to its potential for heap-based buffer overflow attacks.
How do I fix CVE-2021-3482?
To fix CVE-2021-3482, update Exiv2 to version 0.27.4 or later, or apply patches provided by your operating system vendor.
What systems are affected by CVE-2021-3482?
CVE-2021-3482 affects Exiv2 versions prior to 0.27.4-RC1 across multiple Linux distributions including Debian and Red Hat.
What type of vulnerabilities does CVE-2021-3482 exploit?
CVE-2021-3482 exploits improper input validation leading to buffer overflow vulnerabilities in handling crafted JPG images.
Is CVE-2021-3482 a remote code execution vulnerability?
Yes, CVE-2021-3482 can lead to remote code execution under certain conditions due to the buffer overflow.