Homepage

Out-of-bounds Write The advisory has been revoked - it doesn't affect any version of package exiv2-debugsource  (opens in a new tab)

Threat Intelligence

EPSS
2.15% (80th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-EXIV2DEBUGSOURCE-1358045
  • published26 Jul 2021
  • disclosed18 Apr 2021
Report a new vulnerability Found a mistake?

Introduced: 18 Apr 2021

CVE-2021-29457  (opens in a new tab)
CWE-787  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream exiv2-debugsource package and not the exiv2-debugsource package as distributed by RHEL.

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A heap buffer overflow was found in Exiv2 versions v0.27.3 and earlier. The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to gain code execution, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as insert. The bug is fixed in version v0.27.4.

References