Integer overflow in the exif_data_load_data_entry function in exif-data.c in libexif before 0.6.14 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted EXIF data.

Updated packages have been patched to prevent this issue.

This update to the latest upstream release fixes a number of bugs, among them a possible integer overflow in the exif_data_load_data_entry function (CVE-2007-2645), which allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted EXIF data.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service problem (crash) was fixed in the EXIF Loader of libexif, which could be used to crash the browser or image viewer when it interprets the EXIF tags in prepared JPEG files. (CVE-2007-2645)

Several vulnerabilities have been discovered in the EXIF parsing code of the libexif library, which can lead to denial of service or the execution of arbitrary code if a user is tricked into opening a malformed image. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2645     Victor Stinner discovered an integer overflow, which may     result in denial of service or potentially the execution     of arbitrary code.

  - CVE-2007-6351     Meder Kydyraliev discovered an infinite loop, which may     result in denial of service.

  - CVE-2007-6352     Victor Stinner discovered an integer overflow, which may     result in denial of service or potentially the execution     of arbitrary code.

This update also fixes two potential NULL pointer deferences.

The remote host is affected by the vulnerability described in GLSA-200706-01 (libexif: Integer overflow vulnerability)

    Victor Stinner reported an integer overflow in the     exif_data_load_data_entry() function from file exif-data.c while     handling Exif data.
  Impact :

    An attacker could entice a user to process a file with specially     crafted Exif extensions with an application making use of libexif,     which will trigger the integer overflow and potentially execute     arbitrary code or crash the application.
  Workaround :

    There is no known workaround at this time.

Victor Stinner discovered that libexif did not correctly validate the size of some EXIF header fields. By tricking a user into opening an image with specially crafted EXIF headers, a remote attacker could cause the application using libexif to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
25475	Mandrake Linux Security Advisory : libexif (MDKSA-2007:118)	Nessus	Mandriva Local Security Checks	6/12/2007	1/6/2021	high
62265	Fedora 7 : libexif-0.6.15-1.fc7 (2007-0003)	Nessus	Fedora Local Security Checks	9/24/2012	1/11/2021	high
41136	SuSE9 Security Update : libexif (YOU Patch Number 11555)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	high
27318	openSUSE 10 Security Update : libexif (libexif-3718)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high
30226	Debian DSA-1487-1 : libexif - several vulnerabilities	Nessus	Debian Local Security Checks	2/11/2008	1/4/2021	high
29499	SuSE 10 Security Update : libexif (ZYPP Patch Number 3721)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	high
25438	GLSA-200706-01 : libexif: Integer overflow vulnerability	Nessus	Gentoo Local Security Checks	6/7/2007	1/6/2021	high
27320	openSUSE 10 Security Update : libexif5 (libexif5-3724)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high
29500	SuSE 10 Security Update : libexif5 (ZYPP Patch Number 3723)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	high
27317	openSUSE 10 Security Update : libexif (libexif-3703)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high
28072	Ubuntu 6.06 LTS / 6.10 / 7.04 : libexif vulnerability (USN-471-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	high
27319	openSUSE 10 Security Update : libexif5 (libexif5-3704)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high