CVE-2021-37618: Out-of-bounds read in Exiv2::Jp2Image::printStructure
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (-p C). The bug is fixed in version v0.27.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Exiv2to a version that resolves this vulnerability.Fixed in v0.27.5Patch GHSA-583f-w9pm-99r2 - Configuration
Avoid triggering the bug by not using the extra command line option `-p C` that causes Exiv2 to print the image ICC profile.
Exiv2 command-line utility ICC profile printing option = Do not use -p C
Event History
Frequently Asked Questions
What is the severity of CVE-2021-37618?
CVE-2021-37618 has been classified as a medium severity vulnerability due to the potential risk of information disclosure.
How does CVE-2021-37618 affect Exiv2?
CVE-2021-37618 affects Exiv2 versions v0.27.4 and earlier, enabling an out-of-bounds read when handling crafted image metadata.
How do I fix CVE-2021-37618?
To fix CVE-2021-37618, you should upgrade Exiv2 to version 0.27.5 or later, where the vulnerability is resolved.
Which software is impacted by CVE-2021-37618?
CVE-2021-37618 impacts Exiv2 as well as Fedora versions 33 and 34, which include vulnerable versions of the Exiv2 library.
What causes the vulnerability in CVE-2021-37618?
The vulnerability in CVE-2021-37618 is caused by an out-of-bounds read triggered when Exiv2 prints metadata from specially crafted image files.