An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libexif packages installed that are affected by multiple vulnerabilities:

  - In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote     escalation of privilege in the media content provider with no additional execution privileges needed. User     interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774     (CVE-2019-9278)

  - In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1     Android-9 Android-10Android ID: A-148705132 (CVE-2020-0093)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:
    A-147140917 (CVE-2020-0182)

  - exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. (CVE-2020-12767)

  - An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free conditions. (CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote     data could lead to consumption of large amounts of compute time for decoding EXIF data. (CVE-2020-13114)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libexif packages installed that are affected by multiple vulnerabilities:

  - In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote     escalation of privilege in the media content provider with no additional execution privileges needed. User     interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774     (CVE-2019-9278)

  - exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. (CVE-2020-12767)

  - An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free conditions. (CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote     data could lead to consumption of large amounts of compute time for decoding EXIF data. (CVE-2020-13114)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:
    A-147140917 (CVE-2020-0182)

  - In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1     Android-9 Android-10Android ID: A-148705132 (CVE-2020-0093)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a third party app used this library to process     remote image data with no additional execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731 (CVE-2020-0452)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has libexif packages installed that are affected by multiple vulnerabilities:

  - In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote     escalation of privilege in the media content provider with no additional execution privileges needed. User     interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774     (CVE-2019-9278)

  - exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. (CVE-2020-12767)

  - An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free conditions. (CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote     data could lead to consumption of large amounts of compute time for decoding EXIF data. (CVE-2020-13114)

  - In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer     overflow. This could lead to remote denial of service with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076     (CVE-2020-0181)

  - In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow.
    This could lead to remote denial of service with no additional execution privileges needed. User     interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941     (CVE-2020-0198)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:
    A-147140917 (CVE-2020-0182)

  - In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1     Android-9 Android-10Android ID: A-148705132 (CVE-2020-0093)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a third party app used this library to process     remote image data with no additional execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731 (CVE-2020-0452)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4766 advisory.

  - libexif: out of bounds write in exif-data.c (CVE-2019-9278)

  - libexif: out of bounds read due to a missing bounds check in exif_data_save_data_entry function in exif-     data.c (CVE-2020-0093)

  - libexif: integer overflow in exif_data_load_data_thumbnail function in exif-data.c (CVE-2020-0181)

  - libexif: out of bounds read due to a missing bounds check in exif_entry_get_value function in exif-entry.c     (CVE-2020-0182)

  - libexif: integer overflow in exif_data_load_data_content function in exif-data.c (CVE-2020-0198)

  - libexif: divide-by-zero in exif_entry_get_value function in exif-entry.c (CVE-2020-12767)

  - libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and use-after-free     (CVE-2020-13113)

  - libexif: unrestricted size in handling Canon EXIF MakerNote data can lead to consumption of large amounts     of compute time (CVE-2020-13114)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4766 advisory.

  - libexif: out of bounds write in exif-data.c (CVE-2019-9278)

  - libexif: out of bounds read due to a missing bounds check in exif_data_save_data_entry function in exif-     data.c (CVE-2020-0093)

  - libexif: integer overflow in exif_data_load_data_thumbnail function in exif-data.c (CVE-2020-0181)

  - libexif: out of bounds read due to a missing bounds check in exif_entry_get_value function in exif-entry.c     (CVE-2020-0182)

  - libexif: integer overflow in exif_data_load_data_content function in exif-data.c (CVE-2020-0198)

  - libexif: divide-by-zero in exif_entry_get_value function in exif-entry.c (CVE-2020-12767)

  - libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and use-after-free     (CVE-2020-13113)

  - libexif: unrestricted size in handling Canon EXIF MakerNote data can lead to consumption of large amounts     of compute time (CVE-2020-13114)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4766 advisory.

  - exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. (CVE-2020-12767)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:
    A-147140917 (CVE-2020-0182)

  - In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow.
    This could lead to remote denial of service with no additional execution privileges needed. User     interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941     (CVE-2020-0198)

  - In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote     escalation of privilege in the media content provider with no additional execution privileges needed. User     interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774     (CVE-2019-9278)

  - In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer     overflow. This could lead to remote denial of service with no additional execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076     (CVE-2020-0181)

  - An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free conditions. (CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote     data could lead to consumption of large amounts of compute time for decoding EXIF data. (CVE-2020-13114)

  - In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1     Android-9 Android-10Android ID: A-148705132 (CVE-2020-0093)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in libexif before 0.6.22.
    Several buffer over-reads in EXIF MakerNote handling     could lead to information disclosure and     crashes.(CVE-2020-13112)

  - An issue was discovered in libexif before 0.6.22. Use     of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free     conditions.(CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An     unrestricted size in handling Canon EXIF MakerNote data     could lead to consumption of large amounts of compute     time for decoding EXIF data.(CVE-2020-13114)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1523 advisory.

  - In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote     escalation of privilege in the media content provider with no additional execution privileges needed. User     interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774     (CVE-2019-9278)

  - In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1     Android-9 Android-10Android ID: A-148705132 (CVE-2020-0093)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:
    A-147140917 (CVE-2020-0182)

  - exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. (CVE-2020-12767)

  - An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free conditions. (CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote     data could lead to consumption of large amounts of compute time for decoding EXIF data. (CVE-2020-13114)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libexif: out of bound write in exif-data.c     (CVE-2019-9278)

  - libexif: out of bounds read due to a missing bounds     check in exif_data_save_data_entry function in     exif-data.c (CVE-2020-0093)

  - libexif: use of uninitialized memory in EXIF Makernote     handling can lead to crashes and use-after-free     (CVE-2020-13113)

  - libexif: unrestricted size in handling Canon EXIF     MakerNote data can lead to consumption of large amounts     of compute time (CVE-2020-13114)

  - libexif: out of bounds read due to a missing bounds     check in exif_entry_get_value function in exif-entry.c     (CVE-2020-0182)

  - libexif: divide-by-zero in exif_entry_get_value function     in exif-entry.c (CVE-2020-12767)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4040 advisory.

  - libexif: out of bounds write in exif-data.c (CVE-2019-9278)

  - libexif: out of bounds read due to a missing bounds check in exif_data_save_data_entry function in exif-     data.c (CVE-2020-0093)

  - libexif: out of bounds read due to a missing bounds check in exif_entry_get_value function in exif-entry.c     (CVE-2020-0182)

  - libexif: divide-by-zero in exif_entry_get_value function in exif-entry.c (CVE-2020-12767)

  - libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and use-after-free     (CVE-2020-13113)

  - libexif: unrestricted size in handling Canon EXIF MakerNote data can lead to consumption of large amounts     of compute time (CVE-2020-13114)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4040 advisory.

  - In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote     escalation of privilege in the media content provider with no additional execution privileges needed. User     interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774     (CVE-2019-9278)

  - In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1     Android-9 Android-10Android ID: A-148705132 (CVE-2020-0093)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:
    A-147140917 (CVE-2020-0182)

  - exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. (CVE-2020-12767)

  - An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free conditions. (CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote     data could lead to consumption of large amounts of compute time for decoding EXIF data. (CVE-2020-13114)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4040 advisory.

  - libexif: out of bounds write in exif-data.c (CVE-2019-9278)

  - libexif: out of bounds read due to a missing bounds check in exif_data_save_data_entry function in exif-     data.c (CVE-2020-0093)

  - libexif: out of bounds read due to a missing bounds check in exif_entry_get_value function in exif-entry.c     (CVE-2020-0182)

  - libexif: divide-by-zero in exif_entry_get_value function in exif-entry.c (CVE-2020-12767)

  - libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and use-after-free     (CVE-2020-13113)

  - libexif: unrestricted size in handling Canon EXIF MakerNote data can lead to consumption of large amounts     of compute time (CVE-2020-13114)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - exif_entry_get_value in exif-entry.c in libexif 0.6.21     has a divide-by-zero error.(CVE-2020-12767)

  - An issue was discovered in libexif before 0.6.22.
    Several buffer over-reads in EXIF MakerNote handling     could lead to information disclosure and crashes. This     is different from CVE-2020-0093.(CVE-2020-13112)

  - An issue was discovered in libexif before 0.6.22. Use     of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free     conditions.(CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An     unrestricted size in handling Canon EXIF MakerNote data     could lead to consumption of large amounts of compute     time for decoding EXIF data.(CVE-2020-13114)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in libexif before 0.6.22. An     unrestricted size in handling Canon EXIF MakerNote data     could lead to consumption of large amounts of compute     time for decoding EXIF data.(CVE-2020-13114)

  - An issue was discovered in libexif before 0.6.22. Use     of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free     conditions.(CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22.
    Several buffer over-reads in EXIF MakerNote handling     could lead to information disclosure and crashes. This     is different from CVE-2020-0093.(CVE-2020-13112)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in libexif before 0.6.22.
    Several buffer over-reads in EXIF MakerNote handling     could lead to information disclosure and crashes. This     is different from CVE-2020-0093.(CVE-2020-13112)

  - An issue was discovered in libexif before 0.6.22. Use     of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free     conditions.(CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An     unrestricted size in handling Canon EXIF MakerNote data     could lead to consumption of large amounts of compute     time for decoding EXIF data.(CVE-2020-13114)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-05 (libexif: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libexif. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for libexif to 0.6.22 fixes the following issues :

Security issues fixed :

CVE-2016-6328: Fixed an integer overflow in parsing MNOTE entry data of the input file (bsc#1055857).

CVE-2017-7544: Fixed an out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c (bsc#1059893).

CVE-2018-20030: Fixed a denial of service by endless recursion (bsc#1120943).

CVE-2019-9278: Fixed an integer overflow (bsc#1160770).

CVE-2020-0093: Fixed an out-of-bounds read in exif_data_save_data_entry (bsc#1171847).

CVE-2020-12767: Fixed a divide-by-zero error in exif_entry_get_value (bsc#1171475).

CVE-2020-13112: Fixed a time consumption DoS when parsing canon array markers (bsc#1172121).

CVE-2020-13113: Fixed a potential use of uninitialized memory (bsc#1172105).

CVE-2020-13114: Fixed various buffer overread fixes due to integer overflows in maker notes (bsc#1172116).

Non-security issues fixed :

libexif was updated to version 0.6.22 :

  - New translations: ms

  - Updated translations for most languages

  - Some useful EXIF 2.3 tag added :

  - EXIF_TAG_GAMMA

  - EXIF_TAG_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_IMAGE_NUMBER_OF_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_EXPOSURE_TIMES_OF_COMPOSITE_IMAGE

  - EXIF_TAG_GPS_H_POSITIONING_ERROR

  - EXIF_TAG_CAMERA_OWNER_NAME

  - EXIF_TAG_BODY_SERIAL_NUMBER

  - EXIF_TAG_LENS_SPECIFICATION

  - EXIF_TAG_LENS_MAKE

  - EXIF_TAG_LENS_MODEL

  - EXIF_TAG_LENS_SERIAL_NUMBER

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New upstream release. It largely contains stability, security and bugfixes. Some EXIF 2.3 tags have been added. See also:
https://github.com/libexif/libexif/releases/tag/libexif-0_6_22-release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libexif fixes the following issues :

Security issues fixed :

CVE-2016-6328: Fixed an integer overflow in parsing MNOTE entry data of the input file (bsc#1055857).

CVE-2017-7544: Fixed an out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c (bsc#1059893).

CVE-2018-20030: Fixed a denial of service by endless recursion (bsc#1120943).

CVE-2019-9278: Fixed an integer overflow (bsc#1160770).

CVE-2020-0093: Fixed an out-of-bounds read in exif_data_save_data_entry (bsc#1171847).

CVE-2020-12767: Fixed a divide-by-zero error in exif_entry_get_value (bsc#1171475).

CVE-2020-13112: Fixed a time consumption DoS when parsing canon array markers (bsc#1172121).

CVE-2020-13113: Fixed a potential use of uninitialized memory (bsc#1172105).

CVE-2020-13114: Fixed various buffer overread fixes due to integer overflows in maker notes (bsc#1172116).

Non-security issues fixed :

libexif was updated to version 0.6.22 :

  - New translations: ms

  - Updated translations for most languages

  - Some useful EXIF 2.3 tag added :

  - EXIF_TAG_GAMMA

  - EXIF_TAG_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_IMAGE_NUMBER_OF_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_EXPOSURE_TIMES_OF_COMPOSITE_IMAGE

  - EXIF_TAG_GPS_H_POSITIONING_ERROR

  - EXIF_TAG_CAMERA_OWNER_NAME

  - EXIF_TAG_BODY_SERIAL_NUMBER

  - EXIF_TAG_LENS_SPECIFICATION

  - EXIF_TAG_LENS_MAKE

  - EXIF_TAG_LENS_MODEL

  - EXIF_TAG_LENS_SERIAL_NUMBER

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2020-0093, CVE-2020-0182)

It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this issue to cause a remote denial of service. (CVE-2020-0198)

It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information or cause a crash. (CVE-2020-13112)

It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash.
(CVE-2020-13113)

It was discovered libexif incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.
(CVE-2020-13114).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libexif to 0.6.22 fixes the following issues :

Security issues fixed :

  - CVE-2016-6328: Fixed an integer overflow in parsing     MNOTE entry data of the input file (bsc#1055857).

  - CVE-2017-7544: Fixed an out-of-bounds heap read     vulnerability in exif_data_save_data_entry function in     libexif/exif-data.c (bsc#1059893).

  - CVE-2018-20030: Fixed a denial of service by endless     recursion (bsc#1120943).

  - CVE-2019-9278: Fixed an integer overflow (bsc#1160770).

  - CVE-2020-0093: Fixed an out-of-bounds read in     exif_data_save_data_entry (bsc#1171847).

  - CVE-2020-12767: Fixed a divide-by-zero error in     exif_entry_get_value (bsc#1171475).

  - CVE-2020-13112: Fixed a time consumption DoS when     parsing canon array markers (bsc#1172121).

  - CVE-2020-13113: Fixed a potential use of uninitialized     memory (bsc#1172105).

  - CVE-2020-13114: Fixed various buffer overread fixes due     to integer overflows in maker notes (bsc#1172116).

Non-security issues fixed :

  - libexif was updated to version 0.6.22 :

  - New translations: ms

  - Updated translations for most languages

  - Some useful EXIF 2.3 tag added :

  - EXIF_TAG_GAMMA

  - EXIF_TAG_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_IMAGE_NUMBER_OF_COMPOSITE_IMAGE

  - EXIF_TAG_SOURCE_EXPOSURE_TIMES_OF_COMPOSITE_IMAGE

  - EXIF_TAG_GPS_H_POSITIONING_ERROR

  - EXIF_TAG_CAMERA_OWNER_NAME

  - EXIF_TAG_BODY_SERIAL_NUMBER

  - EXIF_TAG_LENS_SPECIFICATION

  - EXIF_TAG_LENS_MAKE

  - EXIF_TAG_LENS_MODEL

  - EXIF_TAG_LENS_SERIAL_NUMBER

This update was imported from the SUSE:SLE-15:Update update project.

Various minor vulnerabilities have been addredd in libexif, a library to parse EXIF metadata files.

CVE-2018-20030

This issue had already been addressed via DLA-2214-1. However, upstream provided an updated patch, so this has been followed up on.

CVE-2020-13112

Several buffer over-reads in EXIF MakerNote handling could have lead to information disclosure and crashes. This issue is different from already resolved CVE-2020-0093.

CVE-2020-13113

Use of uninitialized memory in EXIF Makernote handling could have lead to crashes and potential use-after-free conditions.

CVE-2020-13114

An unrestricted size in handling Canon EXIF MakerNote data could have lead to consumption of large amounts of compute time for decoding EXIF data.

For Debian 8 'Jessie', these problems have been fixed in version 0.6.21-2+deb8u3.

We recommend that you upgrade your libexif packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libexif packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

ID	Name	Product	Family	Severity
154542	NewStart CGSL CORE 5.05 / MAIN 5.05 : libexif Multiple Vulnerabilities (NS-SA-2021-0158)	Nessus	NewStart CGSL Local Security Checks	high
147354	NewStart CGSL CORE 5.04 / MAIN 5.04 : libexif Multiple Vulnerabilities (NS-SA-2021-0036)	Nessus	NewStart CGSL Local Security Checks	critical
147324	NewStart CGSL MAIN 6.02 : libexif Multiple Vulnerabilities (NS-SA-2021-0068)	Nessus	NewStart CGSL Local Security Checks	critical
145847	CentOS 8 : libexif (CESA-2020:4766)	Nessus	CentOS Local Security Checks	high
143097	RHEL 8 : libexif (RHSA-2020:4766)	Nessus	Red Hat Local Security Checks	high
142767	Oracle Linux 8 : libexif (ELSA-2020-4766)	Nessus	Oracle Linux Local Security Checks	high
142348	EulerOS 2.0 SP2 : libexif (EulerOS-SA-2020-2356)	Nessus	Huawei Local Security Checks	critical
141959	Amazon Linux 2 : libexif (ALAS-2020-1523)	Nessus	Amazon Linux Local Security Checks	high
141702	Scientific Linux Security Update : libexif on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	high
141618	CentOS 7 : libexif (CESA-2020:4040)	Nessus	CentOS Local Security Checks	high
141222	Oracle Linux 7 : libexif (ELSA-2020-4040)	Nessus	Oracle Linux Local Security Checks	high
141036	RHEL 7 : libexif (RHSA-2020:4040)	Nessus	Red Hat Local Security Checks	high
140909	EulerOS 2.0 SP3 : libexif (EulerOS-SA-2020-2142)	Nessus	Huawei Local Security Checks	critical
140144	EulerOS 2.0 SP5 : libexif (EulerOS-SA-2020-1923)	Nessus	Huawei Local Security Checks	critical
139139	EulerOS 2.0 SP8 : libexif (EulerOS-SA-2020-1809)	Nessus	Huawei Local Security Checks	critical
138928	GLSA-202007-05 : libexif: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
138264	SUSE SLED15 / SLES15 Security Update : libexif (SUSE-SU-2020:1553-2)	Nessus	SuSE Local Security Checks	critical
137787	Fedora 31 : libexif (2020-085150ac6e)	Nessus	Fedora Local Security Checks	critical
137592	SUSE SLED15 / SLES15 Security Update : libexif (SUSE-SU-2020:1553-1)	Nessus	SuSE Local Security Checks	critical
137584	SUSE SLES12 Security Update : libexif (SUSE-SU-2020:1534-1)	Nessus	SuSE Local Security Checks	critical
137554	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libexif vulnerabilities (USN-4396-1)	Nessus	Ubuntu Local Security Checks	critical
137392	openSUSE Security Update : libexif (openSUSE-2020-793)	Nessus	SuSE Local Security Checks	critical
136952	Debian DLA-2222-1 : libexif security update	Nessus	Debian Local Security Checks	critical
136729	Slackware 14.0 / 14.1 / 14.2 / current : libexif (SSA:2020-140-02)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2020-13113

high

Tenable Plugins

high

critical

critical

high

high

high

critical

high

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical