低危 exiv2 exiv2 除零错误

CVE编号

CVE-2021-34335

利用情况

暂无

补丁情况

官方补丁

披露时间

2021-08-10
漏洞描述
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. A floating point exception (FPE) due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5.
解决建议
下载相关补丁
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 exiv2 exiv2 * Up to
(including)
0.27.4
运行在以下环境
系统 alpine_3.14 exiv2 * Up to
(excluding)
0.27.5-r0
运行在以下环境
系统 alpine_3.15 exiv2 * Up to
(excluding)
0.27.5-r0
运行在以下环境
系统 alpine_3.16 exiv2 * Up to
(excluding)
0.27.5-r0
运行在以下环境
系统 alpine_3.17 exiv2 * Up to
(excluding)
0.27.5-r0
运行在以下环境
系统 alpine_3.18 exiv2 * Up to
(excluding)
0.27.5-r0
运行在以下环境
系统 alpine_3.19 exiv2 * Up to
(excluding)
0.27.5-r0
运行在以下环境
系统 debian_10 exiv2 * Up to
(excluding)
0.25-4+deb10u4
运行在以下环境
系统 debian_11 exiv2 * Up to
(excluding)
0.27.3-3+deb11u2
运行在以下环境
系统 debian_12 exiv2 * Up to
(excluding)
0.27.5-1
运行在以下环境
系统 fedora_33 mingw-exiv2 * Up to
(excluding)
0.27.4-3.fc33
运行在以下环境
系统 fedora_34 mingw-exiv2 * Up to
(excluding)
0.27.4-3.fc34
运行在以下环境
系统 kylinos_aarch64_V10SP1 exiv2 * Up to
(excluding)
0.27.5-1.ky10
运行在以下环境
系统 kylinos_aarch64_V10SP2 exiv2 * Up to
(excluding)
0.27.5-1.ky10
运行在以下环境
系统 kylinos_loongarch64_V10SP1 exiv2 * Up to
(excluding)
0.27.5-1.a.ky10
运行在以下环境
系统 kylinos_x86_64_V10SP1 exiv2 * Up to
(excluding)
0.27.5-1.ky10
运行在以下环境
系统 kylinos_x86_64_V10SP2 exiv2 * Up to
(excluding)
0.27.5-1.ky10
运行在以下环境
系统 ubuntu_20.04 exiv2 * Up to
(excluding)
0.27.2-8ubuntu2.6
运行在以下环境
系统 ubuntu_21.04 exiv2 * Up to
(excluding)
0.27.3-3ubuntu1.5
运行在以下环境
系统 ubuntu_21.10 exiv2 * Up to
(excluding)
0.27.3-3ubuntu4
运行在以下环境
系统 ubuntu_22.04 exiv2 * Up to
(excluding)
0.27.3-3ubuntu4
阿里云评分
3.5
  • 攻击路径
    本地
  • 攻击复杂度
    容易
  • 权限要求
    无需权限
  • 影响范围
    有限影响
  • EXP成熟度
    未验证
  • 补丁情况
    官方补丁
  • 数据保密性
    无影响
  • 数据完整性
    无影响
  • 服务器危害
    DoS
  • 全网数量
    N/A
CWE-ID 漏洞类型
CWE-369 除零错误
阿里云安全产品覆盖情况