In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libexif: Out-of-bounds heap read in exif_data_save_data_entry function (CVE-2017-7544)

  - A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input     file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap     chunk metadata, even other applications' private data). (CVE-2016-6328)

  - An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version     0.6.21 can be exploited to exhaust available CPU resources. (CVE-2018-20030)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1168-1 advisory.

  - In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer     overflow. This could lead to remote denial of service with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076     (CVE-2020-0181)

  - In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow.
    This could lead to remote denial of service with no additional execution privileges needed. User     interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941     (CVE-2020-0198)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a third party app used this library to process     remote image data with no additional execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731 (CVE-2020-0452)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1148-1 advisory.

  - In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer     overflow. This could lead to remote denial of service with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076     (CVE-2020-0181)

  - In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow.
    This could lead to remote denial of service with no additional execution privileges needed. User     interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941     (CVE-2020-0198)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a third party app used this library to process     remote image data with no additional execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731 (CVE-2020-0452)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libexif packages installed that are affected by multiple vulnerabilities:

  - In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote     escalation of privilege in the media content provider with no additional execution privileges needed. User     interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774     (CVE-2019-9278)

  - exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. (CVE-2020-12767)

  - An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free conditions. (CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote     data could lead to consumption of large amounts of compute time for decoding EXIF data. (CVE-2020-13114)

  - In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer     overflow. This could lead to remote denial of service with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076     (CVE-2020-0181)

  - In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow.
    This could lead to remote denial of service with no additional execution privileges needed. User     interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941     (CVE-2020-0198)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:
    A-147140917 (CVE-2020-0182)

  - In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1     Android-9 Android-10Android ID: A-148705132 (CVE-2020-0093)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a third party app used this library to process     remote image data with no additional execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731 (CVE-2020-0452)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In exif_data_save_data_entry of exif-data.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with no additional execution privileges needed. User     interaction is needed for exploitation.Product:
    AndroidVersions: Android-8.0 Android-8.1 Android-9     Android-10Android ID: A-148705132(CVE-2020-0093)

  - In exif_entry_get_value of exif-entry.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10Android ID:
    A-147140917(CVE-2020-0182)

  - In exif_data_load_data_content of exif-data.c, there is     a possible UBSAN abort due to an integer overflow. This     could lead to remote denial of service with no     additional execution privileges needed. User     interaction is needed for exploitation.Product:
    AndroidVersions: Android-10Android ID:
    A-146428941(CVE-2020-0198)

  - In libexif, there is a possible out of bounds write due     to an integer overflow. This could lead to remote     escalation of privilege in the media content provider     with no additional execution privileges needed. User     interaction is needed for exploitation. Product:
    AndroidVersions: Android-10Android ID:
    A-112537774(CVE-2019-9278)

  - In exif_data_load_data_thumbnail of exif-data.c, there     is a possible denial of service due to an integer     overflow. This could lead to remote denial of service     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10Android ID:
    A-145075076(CVE-2020-0181)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4766 advisory.

  - libexif: out of bounds write in exif-data.c (CVE-2019-9278)

  - libexif: out of bounds read due to a missing bounds check in exif_data_save_data_entry function in exif-     data.c (CVE-2020-0093)

  - libexif: integer overflow in exif_data_load_data_thumbnail function in exif-data.c (CVE-2020-0181)

  - libexif: out of bounds read due to a missing bounds check in exif_entry_get_value function in exif-entry.c     (CVE-2020-0182)

  - libexif: integer overflow in exif_data_load_data_content function in exif-data.c (CVE-2020-0198)

  - libexif: divide-by-zero in exif_entry_get_value function in exif-entry.c (CVE-2020-12767)

  - libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and use-after-free     (CVE-2020-13113)

  - libexif: unrestricted size in handling Canon EXIF MakerNote data can lead to consumption of large amounts     of compute time (CVE-2020-13114)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In exif_data_load_data_thumbnail of exif-data.c, there     is a possible denial of service due to an integer     overflow. This could lead to remote denial of service     with no additional execution privileges needed. User     interaction is not needed for     exploitation.(CVE-2020-0181)

  - In exif_data_load_data_content of exif-data.c, there is     a possible UBSAN abort due to an integer overflow. This     could lead to remote denial of service with no     additional execution privileges needed. User     interaction is needed for exploitation.(CVE-2020-0198)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libexif, there is a possible out of bounds write due     to an integer overflow. This could lead to remote     escalation of privilege in the media content provider     with no additional execution privileges needed. User     interaction is needed for exploitation. (CVE-2019-9278)

  - In exif_data_load_data_thumbnail of exif-data.c, there     is a possible denial of service due to an integer     overflow. This could lead to remote denial of service     with no additional execution privileges needed. User     interaction is not needed for     exploitation.(CVE-2020-0181)

  - In exif_data_save_data_entry of exif-data.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with no additional execution privileges needed. User     interaction is needed for exploitation.(CVE-2020-0093)

  - In exif_data_load_data_content of exif-data.c, there is     a possible UBSAN abort due to an integer overflow. This     could lead to remote denial of service with no     additional execution privileges needed. User     interaction is needed for exploitation.(CVE-2020-0198)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2020-0181, CVE-2020-0198, and CVE-2020-0452

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4766 advisory.

    The libexif packages provide a library for extracting extra information from image files.

    The following packages have been upgraded to a later upstream version: libexif (0.6.22). (BZ#1841320)

    Security Fix(es):

    * libexif: out of bounds write in exif-data.c (CVE-2019-9278)

    * libexif: out of bounds read due to a missing bounds check in exif_data_save_data_entry function in exif-     data.c (CVE-2020-0093)

    * libexif: integer overflow in exif_data_load_data_thumbnail function in exif-data.c (CVE-2020-0181)

    * libexif: integer overflow in exif_data_load_data_content function in exif-data.c (CVE-2020-0198)

    * libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and use-after-free     (CVE-2020-13113)

    * libexif: unrestricted size in handling Canon EXIF MakerNote data can lead to consumption of large     amounts of compute time (CVE-2020-13114)

    * libexif: out of bounds read due to a missing bounds check in exif_entry_get_value function in exif-     entry.c (CVE-2020-0182)

    * libexif: divide-by-zero in exif_entry_get_value function in exif-entry.c (CVE-2020-12767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202011-19 (libexif: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libexif. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4766 advisory.

    - Add patch for CVE-2020-0181/CVE-2020-0198

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libexif, there is a possible out of bounds write due     to an integer overflow. This could lead to remote     escalation of privilege in the media content provider     with no additional execution privileges needed. User     interaction is needed for exploitation. Product:
    AndroidVersions: Android-10Android ID:
    A-112537774(CVE-2019-9278)

  - In exif_data_load_data_thumbnail of exif-data.c, there     is a possible denial of service due to an integer     overflow. This could lead to remote denial of service     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10Android ID:
    A-145075076(CVE-2020-0181)

  - In exif_data_save_data_entry of exif-data.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with no additional execution privileges needed. User     interaction is needed for exploitation.Product:
    AndroidVersions: Android-8.0 Android-8.1 Android-9     Android-10Android ID: A-148705132(CVE-2020-0093)

  - In exif_data_load_data_content of exif-data.c, there is     a possible UBSAN abort due to an integer overflow. This     could lead to remote denial of service with no     additional execution privileges needed. User     interaction is needed for exploitation.Product:
    AndroidVersions: Android-10Android ID:
    A-146428941(CVE-2020-0198)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4396-1 advisory.

    It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this     issue to expose sensitive information. (CVE-2020-0093, CVE-2020-0182)

    It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a remote denial of service. (CVE-2020-0198)

    It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this     issue to expose sensitive information or cause a crash. (CVE-2020-13112)

    It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this     issue to cause a crash. (CVE-2020-13113)

    It was discovered libexif incorrectly handled certain inputs. An attacker could possibly use this issue to     cause a denial of service. (CVE-2020-13114)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The following CVE(s) were reported against src:libexif.

CVE-2020-0182

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed.
User interaction is not needed for exploitation.

CVE-2020-0198

In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.

For Debian 8 'Jessie', these problems have been fixed in version 0.6.21-2+deb8u4.

We recommend that you upgrade your libexif packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198918	RHEL 7 : libexif (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195514	RHEL 5 : libexif (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195504	RHEL 6 : libexif (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
159693	SUSE SLES12 Security Update : libexif (SUSE-SU-2022:1168-1)	Nessus	SuSE Local Security Checks	critical
159652	SUSE SLED15 / SLES15 Security Update : libexif (SUSE-SU-2022:1148-1)	Nessus	SuSE Local Security Checks	critical
147324	NewStart CGSL MAIN 6.02 : libexif Multiple Vulnerabilities (NS-SA-2021-0068)	Nessus	NewStart CGSL Local Security Checks	critical
146696	EulerOS 2.0 SP2 : libexif (EulerOS-SA-2021-1315)	Nessus	Huawei Local Security Checks	high
145847	CentOS 8 : libexif (CESA-2020:4766)	Nessus	CentOS Local Security Checks	high
145764	EulerOS 2.0 SP8 : libexif (EulerOS-SA-2021-1151)	Nessus	Huawei Local Security Checks	high
145100	EulerOS 2.0 SP3 : libexif (EulerOS-SA-2021-1083)	Nessus	Huawei Local Security Checks	high
143255	Fedora 32 : libexif (2020-0aa0fc1b0c)	Nessus	Fedora Local Security Checks	critical
143097	RHEL 8 : libexif (RHSA-2020:4766)	Nessus	Red Hat Local Security Checks	high
142939	GLSA-202011-19 : libexif: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
142928	Fedora 33 : libexif (2020-e99ef3282f)	Nessus	Fedora Local Security Checks	critical
142767	Oracle Linux 8 : libexif (ELSA-2020-4766)	Nessus	Oracle Linux Local Security Checks	high
142124	EulerOS 2.0 SP5 : libexif (EulerOS-SA-2020-2251)	Nessus	Huawei Local Security Checks	high
137554	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libexif vulnerabilities (USN-4396-1)	Nessus	Ubuntu Local Security Checks	critical
137419	Debian DLA-2249-1 : libexif security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-0198

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

high

high

high

critical

high

critical

critical

high

high

critical

medium