CVE-2021-37621

Name of the Vulnerable Software and Affected Versions Exiv2 versions v0.27.4 and earlier

Description The issue is related to an infinite loop in the Exiv2 library, which can be triggered when printing the metadata of a specially crafted image file, potentially allowing a remote attacker to cause a denial of service. This bug is specifically triggered when printing the image ICC profile, a less frequently used operation that requires the extra command line option -p C.

Recommendations For Exiv2 versions v0.27.4 and earlier, update to version v0.27.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the -p C command line option to minimize the risk of exploitation. Restrict access to crafted image files to prevent potential denial of service attacks.