CVE catalog

CVE-2021-32815

exiv2: CVE-2021-32815

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.10% · Oct 25, 2026

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The assertion failure is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when modifying the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such as `fi`. ### Patches The bug is fixed in version v0.27.5. ### References Regression test and bug fix: #1739 ### For more information Please see our [security policy](https://github.com/Exiv2/exiv2/security/policy) for information about Exiv2 security.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianexiv2sid0.28.9+dfsg-1fixed
Debianexiv2forky0.28.9+dfsg-1fixed
Debianexiv2trixie0.28.5+dfsg-1fixed
Debianexiv2bookworm0.27.6-1fixed
Ubuntuexiv2pro0.25-1ubuntu1vulnerable
Ubuntuexiv2pro0.25-2.1vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.1vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.2vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.3vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.4vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.5vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.6vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.7+esm1vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.7+esm2vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.7+esm3vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.7+esm4fixed
Ubuntuexiv218.040.25-3.1vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.1vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.2vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.3vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.4vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.5vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.7vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.9vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.10vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.11fixed
Ubuntuexiv220.040.25-4ubuntu2vulnerable
Ubuntuexiv220.040.25-4ubuntu3vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2.2vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2.4vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2.5vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2.6fixed
Ubuntuexiv2pro0.25-1ubuntu1vulnerable
Ubuntuexiv2pro0.25-2.1vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.1vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.2vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.3vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.4vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.5vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.6vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.7+esm1vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.7+esm2vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.7+esm3vulnerable
Ubuntuexiv2pro0.25-2.1ubuntu16.04.7+esm4fixed
Ubuntuexiv218.040.25-3.1vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.1vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.2vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.3vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.4vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.5vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.7vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.9vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.10vulnerable
Ubuntuexiv218.040.25-3.1ubuntu0.18.04.11fixed
Ubuntuexiv220.040.25-4ubuntu2vulnerable
Ubuntuexiv220.040.25-4ubuntu3vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2.2vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2.4vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2.5vulnerable
Ubuntuexiv220.040.27.2-8ubuntu2.6fixed
Ubuntuexiv222.040.27.3-3ubuntu4fixed
Opensuseexiv2tumbleweed0.27.5-7.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianexiv2sourcesid0.27.5-1not yet assignedNot reported[992705]
Debianexiv2sourceforky0.27.5-1not yet assignedNot reported[992705]
Debianexiv2sourcetrixie0.27.5-1not yet assignedNot reported[992705]
Debianexiv2sourcebookworm0.27.5-1not yet assignedNot reported[992705]
Ubuntuexiv2debpro0.25-2.1ubuntu16.04.7+esm4Not reportedUSN-5043-1Not reported
Ubuntuexiv2deb18.040.25-3.1ubuntu0.18.04.11Not reportedUSN-5043-1Not reported
Ubuntuexiv2deb20.040.27.2-8ubuntu2.6Not reportedUSN-5043-1Not reported
Ubuntuexiv2debpro0.25-2.1ubuntu16.04.7+esm4Not reportedUBUNTU-CVE-2021-32815Not reported
Ubuntuexiv2deb18.040.25-3.1ubuntu0.18.04.11Not reportedUBUNTU-CVE-2021-32815Not reported
Ubuntuexiv2deb20.040.27.2-8ubuntu2.6Not reportedUBUNTU-CVE-2021-32815Not reported
Ubuntuexiv2deb22.040.27.3-3ubuntu4Not reportedUBUNTU-CVE-2021-32815Not reported
Opensuseexiv2rpmtumbleweed0.27.5-7.1Not reportedOPENSUSE-SU-2024:12507-1Not reported

[Debian bug #992705]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [exiv2-lang]Unknown

    Source package: [exiv2]

    Details (1)

    • 0.28.8-2.3 · noarch · tumbleweed

      Unknown · Fixed: 0.27.5-7.1

      Version impact unknown

      dsa · exiv2 · opensuse · tumbleweed

  • [libexiv2-28]Unknown

    Source package: [exiv2]

    Details (1)

    • 0.28.8-2.3 · x86_64 · tumbleweed

      Unknown · Fixed: 0.27.5-7.1

      Version impact unknown

      dsa · exiv2 · opensuse · tumbleweed

  • [libexiv2-28-x86-64-v3]Unknown

    Source package: [exiv2]

    Details (1)

    • 0.28.8-2.3 · x86_64 · tumbleweed

      Unknown · Fixed: 0.27.5-7.1

      Version impact unknown

      dsa · exiv2 · opensuse · tumbleweed

  • [libexiv2-devel]Unknown

    Source package: [exiv2]

    Details (1)

    • 0.28.8-2.3 · x86_64 · tumbleweed

      Unknown · Fixed: 0.27.5-7.1

      Version impact unknown

      dsa · exiv2 · opensuse · tumbleweed

  • [exiv2]Fixed

    Source package: [exiv2]

    Details (1)

    • 0.28.8-2.3 · x86_64 · tumbleweed

      Fixed · Fixed: 0.27.5-7.1

      dsa · exiv2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [exiv2]Fixed
    Details (2)

    • 0.27.6-1 · amd64 · bookworm

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · bookworm; dsa · exiv2 · debian · 12

    • 0.27.6-1 · arm64 · bookworm

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · bookworm; dsa · exiv2 · debian · 12

  • [libexiv2-27]Fixed

    Source package: [exiv2]

    Details (2)

    • 0.27.6-1 · amd64 · bookworm

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · bookworm; dsa · exiv2 · debian · 12

    • 0.27.6-1 · arm64 · bookworm

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · bookworm; dsa · exiv2 · debian · 12

  • [libexiv2-dev]Fixed

    Source package: [exiv2]

    Details (2)

    • 0.27.6-1 · amd64 · bookworm

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · bookworm; dsa · exiv2 · debian · 12

    • 0.27.6-1 · arm64 · bookworm

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · bookworm; dsa · exiv2 · debian · 12

  • [libexiv2-doc]Fixed

    Source package: [exiv2]

    Details (2)

    • 0.27.6-1 · all · bookworm

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · bookworm; dsa · exiv2 · debian · 12

    • 0.27.6-1 · all · bookworm

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · bookworm; dsa · exiv2 · debian · 12

[Debian 13 (Trixie)]

  • [exiv2]Fixed
    Details (2)

    • 0.28.5+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

    • 0.28.5+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

  • [libexiv2-28]Fixed

    Source package: [exiv2]

    Details (2)

    • 0.28.5+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

    • 0.28.5+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

  • [libexiv2-data]Fixed

    Source package: [exiv2]

    Details (2)

    • 0.28.5+dfsg-1 · all · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

    • 0.28.5+dfsg-1 · all · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

  • [libexiv2-dev]Fixed

    Source package: [exiv2]

    Details (2)

    • 0.28.5+dfsg-1 · amd64 · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

    • 0.28.5+dfsg-1 · arm64 · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

  • [libexiv2-doc]Fixed

    Source package: [exiv2]

    Details (2)

    • 0.28.5+dfsg-1 · all · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

    • 0.28.5+dfsg-1 · all · trixie

      Fixed · Fixed: 0.27.5-1

      dsa · exiv2 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]