Vulnerability Description
NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service (DoS) by uploading a malicious JPEG file, causing the application to crash.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libexif Project | Exif | <= 0.6.22 |
| Fedoraproject | Fedora | 32 |
Related Weaknesses (CWE)
References
- https://github.com/libexif/exif/commit/eb84b0e3c5f2a86013b6fcfb800d187896a648faPatchThird Party Advisory
- https://github.com/libexif/exif/commit/f6334d9d32437ef13dc902f0a88a2be0063d9d1cPatchThird Party Advisory
- https://github.com/libexif/exif/issues/4ExploitThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202210-28Third Party Advisory
- https://github.com/libexif/exif/commit/eb84b0e3c5f2a86013b6fcfb800d187896a648faPatchThird Party Advisory
- https://github.com/libexif/exif/commit/f6334d9d32437ef13dc902f0a88a2be0063d9d1cPatchThird Party Advisory
- https://github.com/libexif/exif/issues/4ExploitThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202210-28Third Party Advisory
FAQ
What is CVE-2021-27815?
CVE-2021-27815 is a vulnerability with a CVSS score of 5.5 (MEDIUM). NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service (DoS) by uploading a maliciou...
How severe is CVE-2021-27815?
CVE-2021-27815 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-27815?
Check the references section above for vendor advisories and patch information. Affected products include: Libexif Project Exif, Fedoraproject Fedora.