Summary
USN-5043-1 fixed vulnerabilities in Exiv2. The update introduced a new regression
that could cause a crash in applications using libexiv2. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Exiv2 incorrectly handled certain image files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2021-37620)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | exiv2 | 0.27.2-8ubuntu2.7 |
Vulnerabilities 1
-
Medium 4.7
Out-of-bounds read in XmpTextValue::read()
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read th…