CVE-2021-37616

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description A null pointer dereference was found in Exiv2, which can be triggered when printing the metadata of a crafted image file. This can potentially be exploited by an attacker to cause a denial of service if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when printing the interpreted (translated) data, which requires an extra command line option (-p t or -P t).

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the -p t or -P t command line options to minimize the risk of exploitation.