Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev.

CVE-2007-6351: Loading EXIF data could be used to cause a infinite recursion and crash CVE-2007-6352: Integer overflows in the thumbnail handler could be used to overflow buffers and potentially execute code or crash a program using libexif.

Updated libexif packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libexif packages contain the Exif library. Exif is an image file format specification that enables metadata tags to be added to existing JPEG, TIFF and RIFF files. The Exif library makes it possible to parse an Exif file and read this metadata.

An infinite recursion flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to crash.
(CVE-2007-6351)

An integer overflow flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to execute arbitrary code, or crash. (CVE-2007-6352)

Users of libexif are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

This update fixes to recently discovered vulnerabilities in libexif, CVE-2007-6351 and CVE-2007-6352.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200712-15 (libexif: Multiple vulnerabilities)

    Meder Kydyraliev (Google Security) discovered an integer overflow     vulnerability in the exif_data_load_data_thumbnail() function leading     to a memory corruption (CVE-2007-6352) and an infinite recursion in the     exif_loader_write() function (CVE-2007-6351).
  Impact :

    An attacker could entice the user of an application making use of     libexif to load an image file with specially crafted Exif tags,     possibly resulting in the execution of arbitrary code with the     privileges of the user running the application or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev.

  - Loading EXIF data could be used to cause a infinite     recursion and crash. (CVE-2007-6351)

  - Integer overflows in the thumbnail handler could be used     to overflow buffers and potentially execute code or     crash a program using libexif. (CVE-2007-6352)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-1165 advisory.

    [0.6.13-4.0.2.el5_1.1]
     - Add patch for CVE-2007-6351. Fixes bug #425681
     - Add patch for CVE-2007-6352. Fixes bug #425681

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the EXIF parsing code of the libexif library, which can lead to denial of service or the execution of arbitrary code if a user is tricked into opening a malformed image. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2645     Victor Stinner discovered an integer overflow, which may     result in denial of service or potentially the execution     of arbitrary code.

  - CVE-2007-6351     Meder Kydyraliev discovered an infinite loop, which may     result in denial of service.

  - CVE-2007-6352     Victor Stinner discovered an integer overflow, which may     result in denial of service or potentially the execution     of arbitrary code.

This update also fixes two potential NULL pointer deferences.

An infinite recursion flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to crash.
(CVE-2007-6351)

An integer overflow flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to execute arbitrary code, or crash. (CVE-2007-6352)

An infinite recursion flaw was found in the way that libexif parses Exif image tags. A carefully crafted Exif image file opened by an application linked against libexif could cause the application to crash (CVE-2007-6351).

An integer overflow flaw was also found in how libexif parses Exif image tags. A carefully crafted Exif image file opened by an application linked against libexif could cause the application to crash or execute arbitrary code with the privileges of the user executing the application (CVE-2007-6352).

The updated packages have been patched to correct these issues.

This update fixes two recently discovered vulnerabilities in libexif, CVE-2007-6351 and CVE-2007-6352.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Meder Kydyraliev discovered that libexif did not correctly handle certain EXIF headers. If a user or automated system were tricked into processing a specially crafted image, a remote attacker could cause the application linked against libexif to crash, leading to a denial of service, or possibly executing arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two bugs in libexif were identified by a Google Security Audit done by Meder Kydyraliev.

  - Loading EXIF data could be used to cause a infinite     recursion and crash CVE-2007-6352: Integer overflows in     the thumbnail handler could be used to overflow buffers     and potentially execute code or crash a program using     libexif. (CVE-2007-6351)

ID	Name	Product	Family	Published	Updated	Severity
29958	openSUSE 10 Security Update : libexif (libexif-4886)	Nessus	SuSE Local Security Checks	1/14/2008	1/14/2021	medium
29775	RHEL 5 : libexif (RHSA-2007:1165)	Nessus	Red Hat Local Security Checks	12/24/2007	1/14/2021	medium
29765	Fedora 8 : libexif-0.6.15-5.fc8 (2007-4667)	Nessus	Fedora Local Security Checks	12/24/2007	1/11/2021	medium
29812	GLSA-200712-15 : libexif: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/31/2007	1/6/2021	medium
43664	CentOS 5 : libexif (CESA-2007:1165)	Nessus	CentOS Local Security Checks	1/6/2010	1/4/2021	medium
41185	SuSE9 Security Update : libexif (YOU Patch Number 12045)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	medium
67625	Oracle Linux 5 : Moderate:libexif (ELSA-2007-1165)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	high
30226	Debian DSA-1487-1 : libexif - several vulnerabilities	Nessus	Debian Local Security Checks	2/11/2008	1/4/2021	high
60336	Scientific Linux Security Update : libexif on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
36369	Mandriva Linux Security Advisory : libexif (MDVSA-2008:005)	Nessus	Mandriva Local Security Checks	4/23/2009	1/6/2021	medium
29762	Fedora 7 : libexif-0.6.15-3.fc7 (2007-4608)	Nessus	Fedora Local Security Checks	12/24/2007	1/11/2021	medium
38049	Ubuntu 6.06 LTS / 7.04 / 7.10 : libexif vulnerabilities (USN-654-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	medium
29957	SuSE 10 Security Update : libexif (ZYPP Patch Number 4884)	Nessus	SuSE Local Security Checks	1/14/2008	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium