1. CVE-Search
  2. CVE-2021-37615
ID CVE-2021-37615
Summary Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5.
References
Vulnerable Configurations
  • cpe:2.3:a:exiv2:exiv2:-:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:-:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.3:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.4:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.5:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.6:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.7:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.8:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.9:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.10:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.11:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.12:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.13:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.14:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.15:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.16:-:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.16:-:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.16:pre1:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.16:pre1:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.17:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.17.1:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.17.1:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.18:-:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.18:-:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.18:pre1:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.18:pre1:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.18:pre2:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.18:pre2:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.18.1:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.18.1:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.18.2:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.18.2:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.19:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.20:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.21:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.21:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.21.1:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.21.1:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.22:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.22:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.23:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.23:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.24:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.24:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.25:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.25:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.26:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.26:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27:-:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27:-:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27:rc1:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27:rc1:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27:rc2:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27:rc2:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27:rc3:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27:rc3:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27.1:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27.1:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27.2:*:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27.2:*:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27.3:-:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27.3:-:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27.3:rc1:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27.3:rc1:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27.3:rc2:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27.3:rc2:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27.4:rc1:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27.4:rc1:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27.4:rc2:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27.4:rc2:*:*:*:*:*:*
  • cpe:2.3:a:exiv2:exiv2:0.27.4:rc3:*:*:*:*:*:*
    cpe:2.3:a:exiv2:exiv2:0.27.4:rc3:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 22-12-2023 - 10:15)
Impact:
Exploitability:
CWE CWE-476
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:N/A:P
Last major update 22-12-2023 - 10:15
Published 09-08-2021 - 20:15
Last modified 22-12-2023 - 10:15
Back to Top