Vulnerability Name: | CVE-2021-3482 (CCN-199680) | ||||||||||||||||||
Assigned: | 2021-04-05 | ||||||||||||||||||
Published: | 2021-04-05 | ||||||||||||||||||
Updated: | 2022-10-24 | ||||||||||||||||||
Summary: | A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data. | ||||||||||||||||||
CVSS v3 Severity: | 6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) 5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
5.7 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C)
| ||||||||||||||||||
CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P)
| ||||||||||||||||||
Vulnerability Type: | CWE-787 CWE-119 | ||||||||||||||||||
Vulnerability Consequences: | Gain Access | ||||||||||||||||||
References: | Source: MITRE Type: CNA CVE-2021-3482 Source: CCN Type: Red Hat Bugzilla - Bug 1946314 (CVE-2021-3482) - CVE-2021-3482 exiv2: heap-based buffer overflow in Jp2Image::readMetadata() in jp2image.cpp Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://bugzilla.redhat.com/show_bug.cgi?id=1946314 Source: XF Type: UNKNOWN exiv2-cve20213482-bo(199680) Source: CCN Type: exiv2 GIT Repository Heap-buffer-overflow and OOB memory access in src/jp2image.cpp:359:77 #1522 Source: MLIST Type: Mailing List, Third Party Advisory [debian-lts-announce] 20210830 [SECURITY] [DLA 2750-1] exiv2 security update Source: FEDORA Type: Mailing List, Third Party Advisory FEDORA-2021-10d7331a31 Source: FEDORA Type: Mailing List, Third Party Advisory FEDORA-2021-be94728b95 Source: DEBIAN Type: Third Party Advisory DSA-4958 | ||||||||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration 4: Configuration RedHat 1: Configuration RedHat 2: Configuration RedHat 3: ![]() | ||||||||||||||||||
Oval Definitions | |||||||||||||||||||
| |||||||||||||||||||
BACK |