Buffer overflow in Exiv2 - CVE-2021-3482

Vulnerability identifier: #VU55919

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3482

CWE-ID:

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing EXIF data in Jp2Image::readMetadata() in jp2image.cpp. A remote attacker can create a specially crafted EXIF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Exiv2
Arch Linux
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
Fedora
exiv2 (Debian package)
libexiv2-14 (Ubuntu package)
exiv2
exiv2-devel
exiv2-debuginfo
exiv2-debugsource
exiv2-help
libexiv2-27 (Ubuntu package)
exiv2 (Red Hat package)
exiv2-libs

Install updates from vendor's website.

Exiv2 - update to 0.27.4
exiv2 (Debian package) - update to 0.25-4+deb10u2
libexiv2-14 (Ubuntu package) - addressed in versions 0.25-3.1ubuntu0.18.04.7, 0.25-3.1ubuntu0.18.04.11
exiv2 - update to 0.26-25
exiv2-devel - update to 0.26-25
exiv2-debuginfo - update to 0.26-25
exiv2-debugsource - update to 0.26-25
exiv2-help - update to 0.26-25
libexiv2-27 (Ubuntu package) - addressed in versions 0.27.2-8ubuntu2.2, 0.27.3-3ubuntu0.2, 0.27.3-3ubuntu1.1
exiv2 - addressed in versions 0.27.3-6.fc33, 0.27.3-6.fc34
exiv2 (Red Hat package) - update to 0.27.4-5.el8
exiv2 - update to 0.27.5-2
exiv2-libs - update to 0.27.5-2

• https://bugzilla.redhat.com/show_bug.cgi?id=1946314
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/

• Multiple vulnerabilities in Exiv2
• Debian update for exiv2
• openEuler 20.03 LTS SP1 update for exiv2
• Red Hat Enterprise Linux 8 update for exiv2
• Ubuntu update for exiv2
• Arch Linux update for exiv2
• Fedora 34 update for exiv2
• Fedora 33 update for exiv2
• Anolis OS update for exiv2