An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14294-1 advisory.

  - An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version     0.6.21 can be exploited to exhaust available CPU resources. (CVE-2018-20030)

  - In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote     escalation of privilege in the media content provider with no additional execution privileges needed. User     interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774     (CVE-2019-9278)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libexif to 0.6.22 fixes the following issues :

Security issues fixed :

CVE-2016-6328: Fixed an integer overflow in parsing MNOTE entry data of the input file (bsc#1055857).

CVE-2017-7544: Fixed an out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c (bsc#1059893).

CVE-2018-20030: Fixed a denial of service by endless recursion (bsc#1120943).

CVE-2019-9278: Fixed an integer overflow (bsc#1160770).

CVE-2020-0093: Fixed an out-of-bounds read in exif_data_save_data_entry (bsc#1171847).

CVE-2020-12767: Fixed a divide-by-zero error in exif_entry_get_value (bsc#1171475).

CVE-2020-13112: Fixed a time consumption DoS when parsing canon array markers (bsc#1172121).

CVE-2020-13113: Fixed a potential use of uninitialized memory (bsc#1172105).

CVE-2020-13114: Fixed various buffer overread fixes due to integer overflows in maker notes (bsc#1172116).

Non-security issues fixed :

libexif was updated to version 0.6.22 :

  - New translations: ms

  - Updated translations for most languages

  - Some useful EXIF 2.3 tag added :

  - EXIF_TAG_GAMMA

  - EXIF_TAG_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_IMAGE_NUMBER_OF_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_EXPOSURE_TIMES_OF_COMPOSITE_IMAGE

  - EXIF_TAG_GPS_H_POSITIONING_ERROR

  - EXIF_TAG_CAMERA_OWNER_NAME

  - EXIF_TAG_BODY_SERIAL_NUMBER

  - EXIF_TAG_LENS_SPECIFICATION

  - EXIF_TAG_LENS_MAKE

  - EXIF_TAG_LENS_MODEL

  - EXIF_TAG_LENS_SERIAL_NUMBER

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libexif fixes the following issues :

Security issues fixed :

CVE-2016-6328: Fixed an integer overflow in parsing MNOTE entry data of the input file (bsc#1055857).

CVE-2017-7544: Fixed an out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c (bsc#1059893).

CVE-2018-20030: Fixed a denial of service by endless recursion (bsc#1120943).

CVE-2019-9278: Fixed an integer overflow (bsc#1160770).

CVE-2020-0093: Fixed an out-of-bounds read in exif_data_save_data_entry (bsc#1171847).

CVE-2020-12767: Fixed a divide-by-zero error in exif_entry_get_value (bsc#1171475).

CVE-2020-13112: Fixed a time consumption DoS when parsing canon array markers (bsc#1172121).

CVE-2020-13113: Fixed a potential use of uninitialized memory (bsc#1172105).

CVE-2020-13114: Fixed various buffer overread fixes due to integer overflows in maker notes (bsc#1172116).

Non-security issues fixed :

libexif was updated to version 0.6.22 :

  - New translations: ms

  - Updated translations for most languages

  - Some useful EXIF 2.3 tag added :

  - EXIF_TAG_GAMMA

  - EXIF_TAG_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_IMAGE_NUMBER_OF_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_EXPOSURE_TIMES_OF_COMPOSITE_IMAGE

  - EXIF_TAG_GPS_H_POSITIONING_ERROR

  - EXIF_TAG_CAMERA_OWNER_NAME

  - EXIF_TAG_BODY_SERIAL_NUMBER

  - EXIF_TAG_LENS_SPECIFICATION

  - EXIF_TAG_LENS_MAKE

  - EXIF_TAG_LENS_MODEL

  - EXIF_TAG_LENS_SERIAL_NUMBER

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libexif to 0.6.22 fixes the following issues :

Security issues fixed :

  - CVE-2016-6328: Fixed an integer overflow in parsing     MNOTE entry data of the input file (bsc#1055857).

  - CVE-2017-7544: Fixed an out-of-bounds heap read     vulnerability in exif_data_save_data_entry function in     libexif/exif-data.c (bsc#1059893).

  - CVE-2018-20030: Fixed a denial of service by endless     recursion (bsc#1120943).

  - CVE-2019-9278: Fixed an integer overflow (bsc#1160770).

  - CVE-2020-0093: Fixed an out-of-bounds read in     exif_data_save_data_entry (bsc#1171847).

  - CVE-2020-12767: Fixed a divide-by-zero error in     exif_entry_get_value (bsc#1171475).

  - CVE-2020-13112: Fixed a time consumption DoS when     parsing canon array markers (bsc#1172121).

  - CVE-2020-13113: Fixed a potential use of uninitialized     memory (bsc#1172105).

  - CVE-2020-13114: Fixed various buffer overread fixes due     to integer overflows in maker notes (bsc#1172116).

Non-security issues fixed :

  - libexif was updated to version 0.6.22 :

  - New translations: ms

  - Updated translations for most languages

  - Some useful EXIF 2.3 tag added :

  - EXIF_TAG_GAMMA

  - EXIF_TAG_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_IMAGE_NUMBER_OF_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_EXPOSURE_TIMES_OF_COMPOSITE_IMAGE

  - EXIF_TAG_GPS_H_POSITIONING_ERROR

  - EXIF_TAG_CAMERA_OWNER_NAME

  - EXIF_TAG_BODY_SERIAL_NUMBER

  - EXIF_TAG_LENS_SPECIFICATION

  - EXIF_TAG_LENS_MAKE

  - EXIF_TAG_LENS_MODEL

  - EXIF_TAG_LENS_SERIAL_NUMBER

This update was imported from the SUSE:SLE-15:Update update project.

Various minor vulnerabilities have been addredd in libexif, a library to parse EXIF metadata files.

CVE-2018-20030

This issue had already been addressed via DLA-2214-1. However, upstream provided an updated patch, so this has been followed up on.

CVE-2020-13112

Several buffer over-reads in EXIF MakerNote handling could have lead to information disclosure and crashes. This issue is different from already resolved CVE-2020-0093.

CVE-2020-13113

Use of uninitialized memory in EXIF Makernote handling could have lead to crashes and potential use-after-free conditions.

CVE-2020-13114

An unrestricted size in handling Canon EXIF MakerNote data could have lead to consumption of large amounts of compute time for decoding EXIF data.

For Debian 8 'Jessie', these problems have been fixed in version 0.6.21-2+deb8u3.

We recommend that you upgrade your libexif packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libexif packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

Various vulnerabilities have been addressed in libexif, a library to parse EXIF metadata files.

CVE-2016-6328

An integer overflow when parsing the MNOTE entry data of the input file had been found. This could have caused denial of service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).

CVE-2017-7544

libexif had been vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which could have caused denial of service or possibly information disclosure.

CVE-2018-20030

An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version could have been exploited to exhaust available CPU resources.

CVE-2020-0093

In exif_data_save_data_entry of exif-data.c, there was a possible out of bounds read due to a missing bounds check. This could have lead to local information disclosure with no additional execution privileges needed. User interaction was needed for exploitation.

CVE-2020-12767

libexif had a divide-by-zero error in exif_entry_get_value in exif-entry.c

For Debian 8 'Jessie', these problems have been fixed in version 0.6.21-2+deb8u2.

We recommend that you upgrade your libexif packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libexif incorrectly handled certain tags. An attacker could possibly use this issue to cause a denial of service.
(CVE-2018-20030)

It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash.
(CVE-2020-12767).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libexif fixes the following issues :

  - CVE-2019-9278: Fixed an integer overflow (bsc#1160770).

  - CVE-2018-20030: Fixed a denial of service by endless     recursion (bsc#1120943).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libexif fixes the following issues :

CVE-2019-9278: Fixed an integer overflow (bsc#1160770).

CVE-2018-20030: Fixed a denial of service by endless recursion (bsc#1120943).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Most digital cameras produce EXIF files, which are JPEG     files with extra tags that contain information about     the image. The EXIF library allows you to parse an EXIF     file and read the data from those tags.

  - Security fix(es):

  - An error when processing the EXIF_IFD_INTEROPERABILITY     and EXIF_IFD_EXIF tags within libexif version 0.6.21     can be exploited to exhaust available CPU     resources.(CVE-2018-20030)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2018-20030 https://bugzilla.redhat.com/show_bug.cgi?id=1663878

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
150676	SUSE SLES11 Security Update : libexif (SUSE-SU-2020:14294-1)	Nessus	SuSE Local Security Checks	high
138264	SUSE SLED15 / SLES15 Security Update : libexif (SUSE-SU-2020:1553-2)	Nessus	SuSE Local Security Checks	critical
137592	SUSE SLED15 / SLES15 Security Update : libexif (SUSE-SU-2020:1553-1)	Nessus	SuSE Local Security Checks	critical
137584	SUSE SLES12 Security Update : libexif (SUSE-SU-2020:1534-1)	Nessus	SuSE Local Security Checks	critical
137392	openSUSE Security Update : libexif (openSUSE-2020-793)	Nessus	SuSE Local Security Checks	critical
136952	Debian DLA-2222-1 : libexif security update	Nessus	Debian Local Security Checks	critical
136729	Slackware 14.0 / 14.1 / 14.2 / current : libexif (SSA:2020-140-02)	Nessus	Slackware Local Security Checks	critical
136674	Debian DLA-2214-1 : libexif security update	Nessus	Debian Local Security Checks	critical
136607	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libexif vulnerabilities (USN-4358-1)	Nessus	Ubuntu Local Security Checks	high
134194	openSUSE Security Update : libexif (openSUSE-2020-264)	Nessus	SuSE Local Security Checks	high
134078	SUSE SLED15 / SLES15 Security Update : libexif (SUSE-SU-2020:0458-1)	Nessus	SuSE Local Security Checks	high
134077	SUSE SLED12 / SLES12 Security Update : libexif (SUSE-SU-2020:0457-1)	Nessus	SuSE Local Security Checks	high
127018	EulerOS 2.0 SP8 : libexif (EulerOS-SA-2019-1781)	Nessus	Huawei Local Security Checks	high
123615	EulerOS 2.0 SP5 : libexif (EulerOS-SA-2019-1141)	Nessus	Huawei Local Security Checks	high
123590	EulerOS 2.0 SP2 : libexif (EulerOS-SA-2019-1116)	Nessus	Huawei Local Security Checks	high
123108	EulerOS 2.0 SP3 : libexif (EulerOS-SA-2019-1095)	Nessus	Huawei Local Security Checks	high
122555	Fedora 28 : libexif (2019-02e13cb1a8)	Nessus	Fedora Local Security Checks	high
122200	Fedora 29 : libexif (2019-e2f47b40a3)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-20030

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high

high

high