Alpine: multiple exiv2 packages: security update to 0.27.3-r2

low Tenable Cloud Security Plugin ID 404258

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata
of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds
read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could
potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick
the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing
the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to
trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such
as `insert`. The bug is fixed in version v0.27.4. (CVE-2021-29463)

- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata
of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds
read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could
potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick
the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing
the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to
trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such
as insert. The bug is fixed in version v0.27.4. (CVE-2021-29470)

- Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and
ICC image metadata. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. Exiv2 is a
command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image
files. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file.
An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if
they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered
when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For
example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line
argument such as `insert`. The bug is fixed in version v0.27.4. Please see our security policy for
information about Exiv2 security. (CVE-2021-29473)

- Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and
ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2
is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of
image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a
crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack
memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in
version v0.27.4. (CVE-2021-29623)

- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata
of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and
earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image
file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can
trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note
that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2
operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line
application, you need to add an extra command-line argument such as `rm`. (CVE-2021-32617)

Plugin Details

Severity: Low

ID: 404258

Version: Revision 1.27

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-29623

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.9

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 4/23/2021

Reference Information

CVE: CVE-2021-29463, CVE-2021-29470, CVE-2021-29473, CVE-2021-29623, CVE-2021-32617

Detections

Analytics