CVE-2021-29473

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.3 and earlier

Description An out-of-bounds read was found in Exiv2, triggered when it is used to write metadata into a crafted image file. This could potentially allow an attacker to cause a denial of service by crashing Exiv2 if they can trick the victim into running Exiv2 on a crafted image file. The bug is only triggered when writing metadata, which is a less frequently used operation than reading metadata. For example, to trigger the bug in the Exiv2 command-line application, an extra command-line argument such as insert is needed.

Recommendations For Exiv2 versions v0.27.3 and earlier, update to version v0.27.4 to resolve the issue. As a temporary workaround, consider avoiding the use of the insert command-line argument when running the Exiv2 command-line application on untrusted image files. Restrict access to writing metadata to minimize the risk of exploitation.