Test ID:	1.3.6.1.4.1.25623.1.1.10.2021.0415
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2021-0415)
Summary:	The remote host is missing an update for the 'exiv2' package(s) announced via the MGASA-2021-0415 advisory.
Description:	Summary: The remote host is missing an update for the 'exiv2' package(s) announced via the MGASA-2021-0415 advisory. Vulnerability Insight: The updated exiv2 packages fix security vulnerabilities: An assertion failure is triggered when Exiv2 is used to modify the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file (CVE-2021-32815). An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file (CVE-2021-34334). A floating point exception (FPE) due to an integer divide by zero was found in Exiv2 versions v0.27.4 and earlier. The FPE is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file (CVE-2021-34335). A null pointer dereference was found in Exiv2 versions v0.27.4 and earlier. The null pointer dereference is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file (CVE-2021-37615, CVE-2021-37616). An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds read is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit thevulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file (CVE-2021-37618, CVE-2021-37619, CVE-2021-37620). An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file (CVE-2021-37621, CVE-2021-37622, CVE-2021-37623). Affected Software/OS: 'exiv2' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-32815 https://github.com/Exiv2/exiv2/security/advisories/GHSA-mv9g-fxh2-m49m https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FMDT4PJB7P43WSOM3TRQIY3J33BAFVVE/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/ https://security.gentoo.org/glsa/202312-06 https://github.com/Exiv2/exiv2/pull/1739 https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html Common Vulnerability Exposure (CVE) ID: CVE-2021-34334 https://github.com/Exiv2/exiv2/security/advisories/GHSA-hqjh-hpv8-8r9p https://github.com/Exiv2/exiv2/pull/1766 Common Vulnerability Exposure (CVE) ID: CVE-2021-34335 https://github.com/Exiv2/exiv2/security/advisories/GHSA-pvjp-m4f6-q984 https://github.com/Exiv2/exiv2/pull/1750 Common Vulnerability Exposure (CVE) ID: CVE-2021-37615 https://github.com/Exiv2/exiv2/security/advisories/GHSA-h9x9-4f77-336w https://github.com/Exiv2/exiv2/pull/1758 Common Vulnerability Exposure (CVE) ID: CVE-2021-37616 https://github.com/Exiv2/exiv2/security/advisories/GHSA-54f7-vvj7-545w Common Vulnerability Exposure (CVE) ID: CVE-2021-37618 https://github.com/Exiv2/exiv2/security/advisories/GHSA-583f-w9pm-99r2 https://github.com/Exiv2/exiv2/pull/1759 Common Vulnerability Exposure (CVE) ID: CVE-2021-37619 https://github.com/Exiv2/exiv2/security/advisories/GHSA-mxw9-qx4c-6m8v https://github.com/Exiv2/exiv2/pull/1752 Common Vulnerability Exposure (CVE) ID: CVE-2021-37620 https://github.com/Exiv2/exiv2/security/advisories/GHSA-v5g7-46xf-h728 https://github.com/Exiv2/exiv2/pull/1769 Common Vulnerability Exposure (CVE) ID: CVE-2021-37621 https://github.com/Exiv2/exiv2/security/advisories/GHSA-m479-7frc-gqqg https://github.com/Exiv2/exiv2/pull/1778 Common Vulnerability Exposure (CVE) ID: CVE-2021-37622 https://github.com/Exiv2/exiv2/security/advisories/GHSA-9jh3-fcc3-g6hv https://github.com/Exiv2/exiv2/pull/1788 Common Vulnerability Exposure (CVE) ID: CVE-2021-37623 https://github.com/Exiv2/exiv2/security/advisories/GHSA-mvc4-g5pv-4qqq https://github.com/Exiv2/exiv2/pull/1790
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.