Buffer overflow in the EXIF library (libexif) 0.6.9 does not properly validate the structure of the EXIF tags, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a JPEG image with a crafted EXIF tag.

GNOME 2.6.0_x86: GNOME EXIF tag parsing library for digital camera.
Date this patch was last updated by Sun : Feb/11/16

GNOME 2.6.0_x86: GNOME EXIF tag parsing library for digital camera.
Date this patch was last updated by Sun : Jul/11/13

GNOME 2.6.0: GNOME EXIF tag parsing library for digital cameras.
Date this patch was last updated by Sun : Feb/11/16

GNOME 2.6.0: GNOME EXIF tag parsing library for digital cameras.
Date this patch was last updated by Sun : Jul/11/13

GNOME 2.6.0_x86: libexif Patch.
Date this patch was last updated by Sun : Nov/15/05

Sylvain Defresne reports that libexif is vulnerable to a buffer overflow vulnerability due to insufficient input checking. This could lead crash of applications using libexif.

Sylvain Defresne discovered a buffer overflow in libexif, a library that parses EXIF files (such as JPEG files with extra tags). This bug could be exploited to crash the application and maybe to execute arbitrary code as well.

A buffer overflow was discovered in the way libexif parses EXIF tags.
An attacker could exploit this by creating a special EXIF image file which could cause image viewers linked against libexif to crash.

The updated packages have been patched to correct these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:300 advisory.

  - security flaw (CVE-2005-0664)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200503-17 (libexif: Buffer overflow vulnerability)

    libexif contains a buffer overflow vulnerability in the EXIF tag     validation code. When opening an image with a specially crafted EXIF     tag, the lack of validation can cause applications linked to libexif to     crash.
  Impact :

    A specially crafted EXIF file could crash applications making use     of libexif, potentially allowing the execution of arbitrary code with     the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
107874	Solaris 10 (x86) : 121096-05	Nessus	Solaris Local Security Checks	medium
107873	Solaris 10 (x86) : 121096-04	Nessus	Solaris Local Security Checks	medium
107372	Solaris 10 (sparc) : 121095-05	Nessus	Solaris Local Security Checks	medium
107371	Solaris 10 (sparc) : 121095-04	Nessus	Solaris Local Security Checks	medium
23620	Solaris 9 (x86) : 121093-01	Nessus	Solaris Local Security Checks	low
18957	FreeBSD : libexif -- buffer overflow vulnerability (624fe633-9006-11d9-a22c-0001020eed82)	Nessus	FreeBSD Local Security Checks	low
18056	Debian DSA-709-1 : libexif - buffer overflow	Nessus	Debian Local Security Checks	low
17670	Mandrake Linux Security Advisory : libexif (MDKSA-2005:064)	Nessus	Mandriva Local Security Checks	low
17591	RHEL 4 : libexif (RHSA-2005:300)	Nessus	Red Hat Local Security Checks	high
17319	GLSA-200503-17 : libexif: Buffer overflow vulnerability	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2005-0664

high

Tenable Plugins

medium

medium

medium

medium

low

low

low

low

high

low