CVE-2021-37620— Exiv2 缓冲区错误漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2021-37620の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Out-of-bounds read in XmpTextValue::read()
ソース: CVE Program / CVE List V5
脆弱性説明
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
跨界内存读
ソース: CVE Program / CVE List V5
脆弱性タイトル
Exiv2 缓冲区错误漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Exiv2是Andreas Huggel个人开发者的一套用于管理图像元数据的C++库和命令行应用程序。该产品提供了读取和写入EXIF、IPTC和XMP等多种格式图像元数据的功能。 Exiv2 中存在缓冲区错误漏洞，该漏洞源于产品在读取图片元数据时未能验证数据边界，攻击者可通过特殊的图像文件引发越界读操作进而导致拒绝服务。以下产品及版本受到影响：Exiv2 v0.27.4 版本及之前版本。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2021-37620の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2021-37620のインテリジェンス情報
请登录查看更多情报信息。
CVE-2021-37620 补丁与修复 (1)
CVE-2021-37620 厂商安全公告 (2)
- https://security.gentoo.org/glsa/202312-06vendor-advisory
CVE-2021-37620 邮件列表归档 (3)
Same Patch Batch · Exiv2 · 2021-08-09 · 11 CVEs total
| CVE-2021-32815 | 5.5 MEDIUM | Denial of service due to assertion failure in crwimage_int.cpp |
| CVE-2021-34334 | 5.5 MEDIUM | Denial of service due to integer overflow in loop counter |
| CVE-2021-37616 | 5.5 MEDIUM | Null pointer dereference in Exiv2::Internal::resolveLens0x8ff |
| CVE-2021-37621 | 5.5 MEDIUM | Denial of service due to infinite loop in Image::printIFDStructure |
| CVE-2021-37622 | 5.5 MEDIUM | Denial of service due to infinite loop in JpegBase::printStructure (#1) |
| CVE-2021-37623 | 5.5 MEDIUM | Denial of service due to infinite loop in JpegBase::printStructure (#2) |
| CVE-2021-34335 | 4.7 MEDIUM | Denial of service due to FPE in Exiv2::Internal::resolveLens0xffff |
| CVE-2021-37615 | 4.7 MEDIUM | Null pointer dereference in Exiv2::Internal::resolveLens0x319 |
| CVE-2021-37618 | 4.7 MEDIUM | Out-of-bounds read in Exiv2::Jp2Image::printStructure |
| CVE-2021-37619 | 4.7 MEDIUM | Out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header |
IV. 関連脆弱性
同じ製品: exiv2
- CVE-2026-25884
Exiv2: Out-of-bounds read in CrwMap::decode0x0805 - CVE-2026-27596
Exiv2: Integer Underflow in LoaderNative::getData() Causes H - CVE-2026-27631
Exiv2: Uncaught exception - cannot create std::vector larger - CVE-2025-55304
Exiv2 has quadratic performance in ICC profile parsing in Jp - CVE-2025-54080
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata(
同じベンダー: Exiv2
- CVE-2026-25884
Exiv2: Out-of-bounds read in CrwMap::decode0x0805 - CVE-2026-27596
Exiv2: Integer Underflow in LoaderNative::getData() Causes H - CVE-2026-27631
Exiv2: Uncaught exception - cannot create std::vector larger - CVE-2025-55304
Exiv2 has quadratic performance in ICC profile parsing in Jp - CVE-2025-54080
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata(
同じ弱点: CWE-125
- CVE-2026-75900
Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader - CVE-2026-62291
libheif: Heap out of bounds write in libheif uncompressed en - CVE-2026-62292
libheif: Out-of-bounds read in uncompressed unci tile range - CVE-2026-12632
Out-of-bounds read in Zephyr PTP message parsing from unvali - CVE-2026-50126
adaguc-server GeoJSON coordinate parser (CConvertGeoJSON.cpp
V. CVE-2021-37620へのコメント
まだコメントはありません