CVE-2021-29623

exiv2, fedoraproject fedora

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-29623

Katalog CVE

CVSS 3.3 · Low EPSS 1,1%

Kerentanan Use of Uninitialized Resource pada exiv2, fedoraproject fedora. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4.

Rincian

Terbit di NVD
13 Mei 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-908: Use of Uninitialized Resource
EPSS (30 hari)
1,1% peluang dieksploitasi; lebih tinggi dari 64,8% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
exiv2 exiv2 Semua versi sebelum 0.27.4
fedoraproject fedora Versi 33
fedoraproject fedora Versi 34

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.