Alpine: multiple exiv2 packages: security update to 0.27.5-r0

medium Tenable Self-Hosted Container Security Plugin ID 404260

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata
of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is
triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially
exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on
a crafted image file. Note that this bug is only triggered when deleting the IPTC data, which is a less
frequently used Exiv2 operation that requires an extra command line option (`-d I rm`). The bug is fixed
in version v0.27.5. (CVE-2021-37623)

- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata
of image files. The assertion failure is triggered when Exiv2 is used to modify the metadata of a crafted
image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they
can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when
modifying the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For
example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line
argument such as `fi`. ### Patches The bug is fixed in version v0.27.5. ### References Regression test and
bug fix: #1739 ### For more information Please see our [security
policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.
(CVE-2021-32815)

- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata
of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image
file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can
trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.
(CVE-2021-34334)

- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata
of image files. A floating point exception (FPE) due to an integer divide by zero was found in Exiv2
versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata of a crafted
image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they
can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when
printing the interpreted (translated) data, which is a less frequently used Exiv2 operation that requires
an extra command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5. (CVE-2021-34335)

- Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata
of image files. A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null
pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An
attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the
victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the
interpreted (translated) data, which is a less frequently used Exiv2 operation that requires an extra
command line option (`-p t` or `-P t`). The bug is fixed in version v0.27.5. (CVE-2021-37615)

Plugin Details

Severity: Medium

ID: 404260

Version: Revision 1.27

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 12/4/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2021-37623

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/9/2021

Reference Information

CVE: CVE-2021-32815, CVE-2021-34334, CVE-2021-34335, CVE-2021-37615, CVE-2021-37616, CVE-2021-37618, CVE-2021-37619, CVE-2021-37620, CVE-2021-37621, CVE-2021-37622, CVE-2021-37623

Detections

Analytics