Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.

From Red Hat Security Advisory 2007:0501 :

Updated libexif packages that fix an integer overflow flaw are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libexif package contains the EXIF library. Applications use this library to parse EXIF image files.

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168)

Users of libexif should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168)

This update fixes two recently discovered vulnerabilities in libexif, CVE-2007-6351 and CVE-2007-6352.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sean Larsson discovered that libexif did not correctly verify the size of EXIF components. By tricking a user into opening an image with specially crafted EXIF headers, a remote attacker could cause the application using libexif to execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The libexif package contains the EXIF library. Applications use this library to parse EXIF image files.

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168)

Users of libexif should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libexif packages are available for Slackware 10.2, 11.0, and
-current to fix a crash and potential security issue.

The remote host is affected by the vulnerability described in GLSA-200706-09 (libexif: Buffer overflow)

    iDefense Labs have discovered that the exif_data_load_data_entry()     function in libexif/exif-data.c improperly handles integer data while     working with an image with many EXIF components, allowing an integer     overflow possibly leading to a heap-based buffer overflow.
  Impact :

    An attacker could entice a user of an application making use of a     vulnerable version of libexif to load a specially crafted image file,     possibly resulting in a crash of the application or the execution of     arbitrary code with the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

Another integer overflow was found in the way libexif parses EXIF image tags. An individual who opened a carefully-crafted EXIF image file could cause the application linked against libexif to crash or possibly execute arbitrary code.

Updated packages have been patched to prevent this issue.

Updated libexif packages that fix an integer overflow flaw are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libexif package contains the EXIF library. Applications use this library to parse EXIF image files.

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168)

Users of libexif should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

A vulnerability has been discovered in libexif, a library to parse EXIF files, which allows denial of service and possible execution of arbitrary code via malformed EXIF data.

ID	Name	Product	Family	Severity
67524	Oracle Linux 4 / 5 : libexif (ELSA-2007-0501)	Nessus	Oracle Linux Local Security Checks	medium
60210	Scientific Linux Security Update : libexif on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
29762	Fedora 7 : libexif-0.6.15-3.fc7 (2007-4608)	Nessus	Fedora Local Security Checks	medium
28079	Ubuntu 6.06 LTS / 6.10 / 7.04 : libexif vulnerability (USN-478-1)	Nessus	Ubuntu Local Security Checks	medium
27666	Fedora 7 : libexif-0.6.15-2.fc7 (2007-0414)	Nessus	Fedora Local Security Checks	medium
25771	Slackware 10.2 / 11.0 / current : libexif (SSA:2007-164-01)	Nessus	Slackware Local Security Checks	medium
25619	Fedora Core 6 : libexif-0.6.15-2.fc6 (2007-614)	Nessus	Fedora Local Security Checks	medium
25594	GLSA-200706-09 : libexif: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
25589	Fedora Core 5 : libexif-0.6.12-5 (2007-605)	Nessus	Fedora Local Security Checks	medium
25563	Mandrake Linux Security Advisory : libexif (MDKSA-2007:128)	Nessus	Mandriva Local Security Checks	medium
25540	RHEL 4 / 5 : libexif (RHSA-2007:0501)	Nessus	Red Hat Local Security Checks	medium
25532	Debian DSA-1310-1 : libexif - integer overflow	Nessus	Debian Local Security Checks	medium
25528	CentOS 4 / 5 : libexif (CESA-2007:0501)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2006-4168

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium