CVE-2021-37616: Null pointer dereference in Exiv2::Internal::resolveLens0x8ff
First published: Mon Aug 09 2021(Updated: )
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Exiv2 Exiv2 | <=0.27.4 | |
| Fedoraproject Fedora | =33 | |
| Fedoraproject Fedora | =34 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Exiv2/exiv2/pull/1758
- https://github.com/Exiv2/exiv2/security/advisories/GHSA-54f7-vvj7-545w
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/
- https://security.gentoo.org/glsa/202312-06
Frequently Asked Questions
What is CVE-2021-37616?
CVE-2021-37616 is a vulnerability in Exiv2, a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files.
How severe is CVE-2021-37616?
CVE-2021-37616 has a severity score of 5.5, indicating a medium level of severity.
What is the impacted software for CVE-2021-37616?
Exiv2 versions up to and including v0.27.4 are impacted by CVE-2021-37616. Fedora versions 33 and 34 are also impacted.
How can I fix CVE-2021-37616?
Update Exiv2 to a version later than v0.27.4, or update Fedora to a version later than 34.
What is the Common Weakness Enumeration (CWE) for CVE-2021-37616?
CVE-2021-37616 is associated with CWE-476, which is a vulnerability that occurs due to improper NULL termination.
- collector/nvd-index
- collector/nvd-api
- agent/author
- agent/title
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/event
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/exiv2
- canonical/exiv2 exiv2
- version/exiv2 exiv2/0.27.4
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33
- version/fedoraproject fedora/34