{"id":"CVE-2021-34334","details":"Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.","aliases":["GHSA-hqjh-hpv8-8r9p"],"modified":"2026-05-15T12:04:37.834731381Z","published":"2021-08-09T18:15:07.513Z","related":["SUSE-SU-2022:3889-1","SUSE-SU-2022:3892-1","SUSE-SU-2022:4252-1","openSUSE-SU-2024:12405-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_FIELD","vendor_product":"debian:debian_linux","extracted_events":[{"last_affected":"10.0"}],"cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"]},{"source":"CPE_FIELD","vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"33"},{"last_affected":"34"}]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202312-06"},{"type":"FIX","url":"https://github.com/Exiv2/exiv2/pull/1766"},{"type":"FIX","url":"https://github.com/Exiv2/exiv2/security/advisories/GHSA-hqjh-hpv8-8r9p"}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}