Debian DLA-2214-1 : libexif security update

critical Nessus Plugin ID 136674


The remote Debian host is missing a security update.


Various vulnerabilities have been addressed in libexif, a library to parse EXIF metadata files.


An integer overflow when parsing the MNOTE entry data of the input file had been found. This could have caused denial of service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).


libexif had been vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which could have caused denial of service or possibly information disclosure.


An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version could have been exploited to exhaust available CPU resources.


In exif_data_save_data_entry of exif-data.c, there was a possible out of bounds read due to a missing bounds check. This could have lead to local information disclosure with no additional execution privileges needed. User interaction was needed for exploitation.


libexif had a divide-by-zero error in exif_entry_get_value in exif-entry.c

For Debian 8 'Jessie', these problems have been fixed in version 0.6.21-2+deb8u2.

We recommend that you upgrade your libexif packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Upgrade the affected libexif-dev, and libexif12 packages.

See Also

Plugin Details

Severity: Critical

ID: 136674

File Name: debian_DLA-2214.nasl

Version: 1.5

Type: local

Agent: unix

Published: 5/18/2020

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent

Risk Information


Risk Factor: Medium

Score: 5.2


Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2017-7544


Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:libexif-dev, p-cpe:/a:debian:debian_linux:libexif12, cpe:/o:debian:debian_linux:8.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 5/18/2020

Vulnerability Publication Date: 9/21/2017

Reference Information

CVE: CVE-2016-6328, CVE-2017-7544, CVE-2018-20030, CVE-2020-0093, CVE-2020-12767