Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p C`). The bug is fixed in version v0.27.5.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-08-09T00:00:00

Updated: 2024-08-04T01:23:01.291Z

Reserved: 2021-07-29T00:00:00

Link: CVE-2021-37618

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-08-09T19:15:07.780

Modified: 2023-12-22T10:15:10.197

Link: CVE-2021-37618

cve-icon Redhat

Severity : Low

Publid Date: 2021-08-08T00:00:00Z

Links: CVE-2021-37618 - Bugzilla