CVE-2021-37615: Null pointer dereference in Exiv2::Internal::resolveLens0x319
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (-p t or -P t). The bug is fixed in version v0.27.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Exiv2to a version that resolves this vulnerability.Fixed in v0.27.5 - Configuration
Avoid invoking Exiv2 with the interpreted/translated printing options `-p t` or `-P t` on untrusted image files until upgraded to v0.27.5; the null pointer dereference is triggered when printing interpreted (translated) data.
Exiv2 command-line utility lens data printing option = do not use -p t or -P t
Event History
Frequently Asked Questions
What is the severity of CVE-2021-37615?
The severity of CVE-2021-37615 is classified as medium due to the potential for null pointer dereference in Exiv2.
How do I fix CVE-2021-37615?
To fix CVE-2021-37615, upgrade Exiv2 to version 0.27.5 or later to resolve the null pointer dereference issue.
Which versions of Exiv2 are affected by CVE-2021-37615?
CVE-2021-37615 affects Exiv2 versions up to and including 0.27.4.
What impact does CVE-2021-37615 have on system security?
CVE-2021-37615 can lead to application crashes or unexpected behavior when dealing with image metadata.
Is there a workaround for CVE-2021-37615?
A temporary workaround for CVE-2021-37615 is to avoid using the vulnerable functionalities in Exiv2 until an upgrade is performed.