CVE-2021-3482
published 2021-04-08CVE-2021-3482: A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in…
PriorityP336medium6.5CVSS 3.1
AVNACLPRNUINSUCLINAL
EPSS
2.30%
81.3th percentile
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | exiv2 | < exiv2 0.27.5-1 (bookworm) | exiv2 0.27.5-1 (bookworm) |
| exiv2 | exiv2 | <= 0.27.3 | — |
| exiv2 | exiv2 | — | — |
| exiv2 | exiv2 | — | — |
| exiv2 | exiv2 | >= 0 < 0.27.3-3+deb11u2 | 0.27.3-3+deb11u2 |
| exiv2 | exiv2 | >= 0 < 0.27.5-1 | 0.27.5-1 |
| exiv2 | exiv2 | >= 0 < 0.27.5-1 | 0.27.5-1 |
| exiv2 | exiv2 | >= 0 < 0.27.5-1 | 0.27.5-1 |
| exiv2 | exiv2 | >= 0 < 0.25-3.1ubuntu0.18.04.7 | 0.25-3.1ubuntu0.18.04.7 |
| exiv2 | exiv2 | >= 0 < 0.27.2-8ubuntu2.2 | 0.27.2-8ubuntu2.2 |
| exiv2 | exiv2 | >= 0 < 0.25-2.1ubuntu16.04.7+esm1 | 0.25-2.1ubuntu16.04.7+esm1 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_exiv2_0.27.5-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian6.5MEDIUM
vendor_msrc6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Exiv2 vulnerabilities
vendor_ubuntu·2021-05-10·CVSS 7.8
CVE-2021-29458 [HIGH] Exiv2 vulnerabilities
Title: Exiv2 vulnerabilities
Summary: Several security issues were fixed in Exiv2.
It was discovered that Exiv2 incorrectly handled certain images.
An attacker could possibly use this issue to execute arbitrary code or cause
a crash. (CVE-2021-29457)
It was discovered that Exiv2 incorrectly handled certain images.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2021-29458, CVE-2021-29470)
It was discovered that Exiv2 incorrectly handled certain images.
An attacker could possibly use this issue to execute arbitrary code or
cause a crash. (CVE-2021-3482)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffe
vendor_msrc·2021-04-13·CVSS 6.5
CVE-2021-3482 [MEDIUM] CWE-787 A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffe
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information.
Red Hat
exiv2: Heap-based buffer overflow in Jp2Image::readMetadata()
vendor_redhat·2021-04-05·CVSS 6.5
CVE-2021-3482 [MEDIUM] CWE-20 exiv2: Heap-based buffer overflow in Jp2Image::readMetadata()
exiv2: Heap-based buffer overflow in Jp2Image::readMetadata()
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.
A flaw was found in Exiv2. Improper input validation of the rawData.size property in the Jp2Image::readMetadata() function in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data. The highest threat from this vulnerability is to confidentiality and system availability.
Package: exiv2 (Red Hat Enterprise Linux 6) - Out of support scope
Package: exiv2 (Red Hat Enterprise Linux 7) - Out of support scope
Packag
Debian
CVE-2021-3482: exiv2 - A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper ...
vendor_debian·2021·CVSS 6.5
CVE-2021-3482 [MEDIUM] CVE-2021-3482: exiv2 - A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper ...
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.
Scope: local
bookworm: resolved (fixed in 0.27.5-1)
bullseye: resolved (fixed in 0.27.3-3+deb11u2)
forky: resolved (fixed in 0.27.5-1)
sid: resolved (fixed in 0.27.5-1)
trixie: resolved (fixed in 0.27.5-1)
GHSA
GHSA-73rc-8qcm-v2wx: A flaw was found in Exiv2 in versions before and including 0
ghsa_unreviewed·2022-05-24
CVE-2021-3482 [MEDIUM] CWE-119 GHSA-73rc-8qcm-v2wx: A flaw was found in Exiv2 in versions before and including 0
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.
OSV
exiv2 vulnerabilities
osv·2021-05-10·CVSS 7.8
CVE-2021-29457 [HIGH] exiv2 vulnerabilities
exiv2 vulnerabilities
It was discovered that Exiv2 incorrectly handled certain images.
An attacker could possibly use this issue to execute arbitrary code or cause
a crash. (CVE-2021-29457)
It was discovered that Exiv2 incorrectly handled certain images.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2021-29458, CVE-2021-29470)
It was discovered that Exiv2 incorrectly handled certain images.
An attacker could possibly use this issue to execute arbitrary code or
cause a crash. (CVE-2021-3482)
OSV
CVE-2021-3482: A flaw was found in Exiv2 in versions before and including 0
osv·2021-04-08·CVSS 6.5
CVE-2021-3482 [MEDIUM] CVE-2021-3482: A flaw was found in Exiv2 in versions before and including 0
A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1946314https://lists.debian.org/debian-lts-announce/2021/08/msg00028.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/https://www.debian.org/security/2021/dsa-4958https://bugzilla.redhat.com/show_bug.cgi?id=1946314https://lists.debian.org/debian-lts-announce/2021/08/msg00028.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XQT5F5IINTDYDAFGVGQZ7PMMLG7I5ZZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/https://www.debian.org/security/2021/dsa-4958
2021-04-08
Published