Integer overflow in libexif 0.6.16 and earlier allows context-dependent attackers to execute arbitrary code via an image with crafted EXIF tags, possibly involving the exif_data_load_data_thumbnail function in exif-data.c.

GNOME 2.6.0_x86: GNOME EXIF tag parsing library for digital camera.
Date this patch was last updated by Sun : Feb/11/16

GNOME 2.6.0_x86: GNOME EXIF tag parsing library for digital camera.
Date this patch was last updated by Sun : Jul/11/13

GNOME 2.6.0: GNOME EXIF tag parsing library for digital cameras.
Date this patch was last updated by Sun : Feb/11/16

GNOME 2.6.0: GNOME EXIF tag parsing library for digital cameras.
Date this patch was last updated by Sun : Jul/11/13

From Red Hat Security Advisory 2007:1166 :

Updated libexif packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libexif packages contain the Exif library. Exif is an image file format specification that enables metadata tags to be added to existing JPEG, TIFF and RIFF files. The Exif library makes it possible to parse an Exif file and read this metadata.

An integer overflow flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to execute arbitrary code, or crash. (CVE-2007-6352)

Users of libexif are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-1165 advisory.

    [0.6.13-4.0.2.el5_1.1]
     - Add patch for CVE-2007-6351. Fixes bug #425681
     - Add patch for CVE-2007-6352. Fixes bug #425681

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An infinite recursion flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to crash.
(CVE-2007-6351)

An integer overflow flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to execute arbitrary code, or crash. (CVE-2007-6352)

Updated libexif packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libexif packages contain the Exif library. Exif is an image file format specification that enables metadata tags to be added to existing JPEG, TIFF and RIFF files. The Exif library makes it possible to parse an Exif file and read this metadata.

An infinite recursion flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to crash.
(CVE-2007-6351)

An integer overflow flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to execute arbitrary code, or crash. (CVE-2007-6352)

Users of libexif are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev.

  - Loading EXIF data could be used to cause a infinite     recursion and crash. (CVE-2007-6351)

  - Integer overflows in the thumbnail handler could be used     to overflow buffers and potentially execute code or     crash a program using libexif. (CVE-2007-6352)

Meder Kydyraliev discovered that libexif did not correctly handle certain EXIF headers. If a user or automated system were tricked into processing a specially crafted image, a remote attacker could cause the application linked against libexif to crash, leading to a denial of service, or possibly executing arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An infinite recursion flaw was found in the way that libexif parses Exif image tags. A carefully crafted Exif image file opened by an application linked against libexif could cause the application to crash (CVE-2007-6351).

An integer overflow flaw was also found in how libexif parses Exif image tags. A carefully crafted Exif image file opened by an application linked against libexif could cause the application to crash or execute arbitrary code with the privileges of the user executing the application (CVE-2007-6352).

The updated packages have been patched to correct these issues.

Several vulnerabilities have been discovered in the EXIF parsing code of the libexif library, which can lead to denial of service or the execution of arbitrary code if a user is tricked into opening a malformed image. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2645     Victor Stinner discovered an integer overflow, which may     result in denial of service or potentially the execution     of arbitrary code.

  - CVE-2007-6351     Meder Kydyraliev discovered an infinite loop, which may     result in denial of service.

  - CVE-2007-6352     Victor Stinner discovered an integer overflow, which may     result in denial of service or potentially the execution     of arbitrary code.

This update also fixes two potential NULL pointer deferences.

One bug in libexif5 was identified by a Google Security Audit done by Meder Kydyraliev.

  - Integer overflows in the thumbnail handler could be used     to overflow buffers and potentially execute code or     crash a program using libexif. (CVE-2007-6352)

One bug in libexif5 was identified by a Google Security Audit done by Meder Kydyraliev.

CVE-2007-6352: Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code or crash a program using libexif.

Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev.

CVE-2007-6351: Loading EXIF data could be used to cause a infinite recursion and crash CVE-2007-6352: Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code or crash a program using libexif.

Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev.

  - Loading EXIF data could be used to cause a infinite     recursion and crash CVE-2007-6352: Integer overflows in     the thumbnail handler could be used to overflow buffers     and potentially execute code or crash a program using     libexif. (CVE-2007-6351)

The remote host is affected by the vulnerability described in GLSA-200712-15 (libexif: Multiple vulnerabilities)

    Meder Kydyraliev (Google Security) discovered an integer overflow     vulnerability in the exif_data_load_data_thumbnail() function leading     to a memory corruption (CVE-2007-6352) and an infinite recursion in the     exif_loader_write() function (CVE-2007-6351).
  Impact :

    An attacker could entice the user of an application making use of     libexif to load an image file with specially crafted Exif tags,     possibly resulting in the execution of arbitrary code with the     privileges of the user running the application or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2007:1166 advisory.

  - libexif integer overflow (CVE-2007-6352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes to recently discovered vulnerabilities in libexif, CVE-2007-6351 and CVE-2007-6352.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes two recently discovered vulnerabilities in libexif, CVE-2007-6351 and CVE-2007-6352.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libexif packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libexif packages contain the Exif library. Exif is an image file format specification that enables metadata tags to be added to existing JPEG, TIFF and RIFF files. The Exif library makes it possible to parse an Exif file and read this metadata.

An integer overflow flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to execute arbitrary code, or crash. (CVE-2007-6352)

Users of libexif are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

ID	Name	Product	Family	Severity
107874	Solaris 10 (x86) : 121096-05	Nessus	Solaris Local Security Checks	medium
107873	Solaris 10 (x86) : 121096-04	Nessus	Solaris Local Security Checks	medium
107372	Solaris 10 (sparc) : 121095-05	Nessus	Solaris Local Security Checks	medium
107371	Solaris 10 (sparc) : 121095-04	Nessus	Solaris Local Security Checks	medium
67626	Oracle Linux 4 : libexif (ELSA-2007-1166)	Nessus	Oracle Linux Local Security Checks	medium
67625	Oracle Linux 5 : Moderate:libexif (ELSA-2007-1165)	Nessus	Oracle Linux Local Security Checks	high
60336	Scientific Linux Security Update : libexif on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43664	CentOS 5 : libexif (CESA-2007:1165)	Nessus	CentOS Local Security Checks	medium
41185	SuSE9 Security Update : libexif (YOU Patch Number 12045)	Nessus	SuSE Local Security Checks	medium
38049	Ubuntu 6.06 LTS / 7.04 / 7.10 : libexif vulnerabilities (USN-654-1)	Nessus	Ubuntu Local Security Checks	medium
36369	Mandriva Linux Security Advisory : libexif (MDVSA-2008:005)	Nessus	Mandriva Local Security Checks	medium
30226	Debian DSA-1487-1 : libexif - several vulnerabilities	Nessus	Debian Local Security Checks	high
29960	SuSE 10 Security Update : libexif5 (ZYPP Patch Number 4883)	Nessus	SuSE Local Security Checks	medium
29959	openSUSE 10 Security Update : libexif5 (libexif5-4882)	Nessus	SuSE Local Security Checks	medium
29958	openSUSE 10 Security Update : libexif (libexif-4886)	Nessus	SuSE Local Security Checks	medium
29957	SuSE 10 Security Update : libexif (ZYPP Patch Number 4884)	Nessus	SuSE Local Security Checks	medium
29812	GLSA-200712-15 : libexif: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
29776	RHEL 4 : libexif (RHSA-2007:1166)	Nessus	Red Hat Local Security Checks	high
29775	RHEL 5 : libexif (RHSA-2007:1165)	Nessus	Red Hat Local Security Checks	medium
29765	Fedora 8 : libexif-0.6.15-5.fc8 (2007-4667)	Nessus	Fedora Local Security Checks	medium
29762	Fedora 7 : libexif-0.6.15-3.fc7 (2007-4608)	Nessus	Fedora Local Security Checks	medium
29753	CentOS 4 : libexif (CESA-2007:1166)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-6352

high

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

high

medium

medium

medium

medium