Homepage

Divide By Zero The advisory has been revoked - it doesn't affect any version of package compat-exiv2-026-debugsource  (opens in a new tab)

Threat Intelligence

EPSS
0.08% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-COMPATEXIV2026DEBUGSOURCE-1568430
  • published21 Aug 2021
  • disclosed8 Aug 2021
Report a new vulnerability Found a mistake?

Introduced: 8 Aug 2021

CVE-2021-34335  (opens in a new tab)
CWE-369  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream compat-exiv2-026-debugsource package and not the compat-exiv2-026-debugsource package as distributed by RHEL.

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception (FPE) due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (-p t or -P t). The bug is fixed in version v0.27.5.