Lucene search

K
freebsdFreeBSDD49F86AB-D9C7-11EB-A200-00155D01F201
HistoryApr 25, 2021 - 12:00 a.m.

Exiv2 -- Multiple vulnerabilities

2021-04-2500:00:00
vuxml.freebsd.org
10

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

77.5%

Exiv2 teams reports:

Multiple vulnerabilities covering buffer overflows, out-of-bounds,
read of uninitialized memory and denial of serivce. The heap
overflow is triggered when Exiv2 is used to read the metadata of
a crafted image file. An attacker could potentially exploit the
vulnerability to gain code execution, if they can trick the victim
into running Exiv2 on a crafted image file. The out-of-bounds read
is triggered when Exiv2 is used to write metadata into a crafted
image file. An attacker could potentially exploit the vulnerability
to cause a denial of service by crashing Exiv2, if they can trick
the victim into running Exiv2 on a crafted image file. The read of
uninitialized memory is triggered when Exiv2 is used to read the
metadata of a crafted image file. An attacker could potentially
exploit the vulnerability to leak a few bytes of stack memory, if
they can trick the victim into running Exiv2 on a crafted image
file.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchexiv2< 0.27.4,1UNKNOWN

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

77.5%