A flaw was found in Exiv2 in versions before and including 0.27.4-RC1. Improper input validation of the rawData.size property in Jp2Image::readMetadata() in jp2image.cpp can lead to a heap-based buffer overflow via a crafted JPG image containing malicious EXIF data.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade exiv2Upgrade exiv2-docUpgrade exiv2-develUpgrade exiv2-libs | May 4, 2022 | Apr 8, 2021 |
| Alpine Linux | — | Upgrade exiv2 | Aug 22, 2024 | Apr 8, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 8, 2021 |
| Centos_linux | — | Upgrade exiv2-debugsourceUpgrade exiv2Upgrade exiv2-libs-debuginfoUpgrade exiv2-libsUpgrade exiv2-debuginfo | Nov 10, 2021 | Apr 8, 2021 |
| Debian | — | Upgrade exiv2 | Aug 16, 2021 | Apr 8, 2021 |
| Freebsd | — | Upgrade exiv2 | Nov 4, 2022 | Jun 30, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade exiv2-libs | Sep 7, 2021 | Apr 8, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade exiv2Upgrade exiv2-libs | Aug 10, 2021 | Apr 8, 2021 |
| Redhat_linux | — | No solution existsUpgrade exiv2-develUpgrade exiv2-debugsourceUpgrade exiv2-docUpgrade exiv2-libs-debuginfoUpgrade exiv2-libsUpgrade exiv2Upgrade exiv2-debuginfo | Nov 10, 2021 | Apr 8, 2021 |
| Rocky_linux | — | Upgrade exiv2-libs-debuginfoUpgrade exiv2-libsUpgrade exiv2-develUpgrade exiv2Upgrade exiv2-debugsourceUpgrade exiv2-debuginfo | Mar 12, 2024 | Apr 8, 2021 |
| Ubuntu | — | Upgrade libexiv2-14Upgrade libexiv2-14 (Ubuntu Pro)Upgrade libexiv2-27 | May 11, 2021 | Apr 8, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub