Integer overflow in the exif_data_load_data_entry function in exif-data.c in libexif before 0.6.14 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted EXIF data, involving the (1) doff or (2) s variable.

This update to the latest upstream release fixes a number of bugs, among them a possible integer overflow in the exif_data_load_data_entry function (CVE-2007-2645), which allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted EXIF data.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service problem (crash) was fixed in the EXIF Loader of libexif, which could be used to crash the browser or image viewer when it interprets the EXIF tags in prepared JPEG files. (CVE-2007-2645)

Several vulnerabilities have been discovered in the EXIF parsing code of the libexif library, which can lead to denial of service or the execution of arbitrary code if a user is tricked into opening a malformed image. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2645     Victor Stinner discovered an integer overflow, which may     result in denial of service or potentially the execution     of arbitrary code.

  - CVE-2007-6351     Meder Kydyraliev discovered an infinite loop, which may     result in denial of service.

  - CVE-2007-6352     Victor Stinner discovered an integer overflow, which may     result in denial of service or potentially the execution     of arbitrary code.

This update also fixes two potential NULL pointer deferences.

Victor Stinner discovered that libexif did not correctly validate the size of some EXIF header fields. By tricking a user into opening an image with specially crafted EXIF headers, a remote attacker could cause the application using libexif to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Integer overflow in the exif_data_load_data_entry function in exif-data.c in libexif before 0.6.14 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted EXIF data.

Updated packages have been patched to prevent this issue.

The remote host is affected by the vulnerability described in GLSA-200706-01 (libexif: Integer overflow vulnerability)

    Victor Stinner reported an integer overflow in the     exif_data_load_data_entry() function from file exif-data.c while     handling Exif data.
  Impact :

    An attacker could entice a user to process a file with specially     crafted Exif extensions with an application making use of libexif,     which will trigger the integer overflow and potentially execute     arbitrary code or crash the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
62265	Fedora 7 : libexif-0.6.15-1.fc7 (2007-0003)	Nessus	Fedora Local Security Checks	high
41136	SuSE9 Security Update : libexif (YOU Patch Number 11555)	Nessus	SuSE Local Security Checks	high
30226	Debian DSA-1487-1 : libexif - several vulnerabilities	Nessus	Debian Local Security Checks	high
29500	SuSE 10 Security Update : libexif5 (ZYPP Patch Number 3723)	Nessus	SuSE Local Security Checks	high
29499	SuSE 10 Security Update : libexif (ZYPP Patch Number 3721)	Nessus	SuSE Local Security Checks	high
28072	Ubuntu 6.06 LTS / 6.10 / 7.04 : libexif vulnerability (USN-471-1)	Nessus	Ubuntu Local Security Checks	high
27320	openSUSE 10 Security Update : libexif5 (libexif5-3724)	Nessus	SuSE Local Security Checks	high
27319	openSUSE 10 Security Update : libexif5 (libexif5-3704)	Nessus	SuSE Local Security Checks	high
27318	openSUSE 10 Security Update : libexif (libexif-3718)	Nessus	SuSE Local Security Checks	high
27317	openSUSE 10 Security Update : libexif (libexif-3703)	Nessus	SuSE Local Security Checks	high
25475	Mandrake Linux Security Advisory : libexif (MDKSA-2007:118)	Nessus	Mandriva Local Security Checks	high
25438	GLSA-200706-01 : libexif: Integer overflow vulnerability	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2007-2645

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high