CVE-2021-37622

描述

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed in version v0.27.5.

如何修補 CVE-2021-37622

要修補 CVE-2021-37622,請將受影響套件升級到下列已修補版本。

• —升級至 0.27.3-3+deb11u2 或更新版本

CVE-2021-37622 正在被利用嗎?

低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.27.3-3+deb11u2

CVSS 分數

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-37622