The libexif package contains the EXIF library. Applications use this library to parse EXIF image files.

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168)

Users of libexif should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered in libexif, a library to parse EXIF files, which allows denial of service and possible execution of arbitrary code via malformed EXIF data.

From Red Hat Security Advisory 2007:0501 :

Updated libexif packages that fix an integer overflow flaw are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libexif package contains the EXIF library. Applications use this library to parse EXIF image files.

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168)

Users of libexif should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

Updated libexif packages that fix an integer overflow flaw are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libexif package contains the EXIF library. Applications use this library to parse EXIF image files.

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168)

Users of libexif should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

This update fixes two recently discovered vulnerabilities in libexif, CVE-2007-6351 and CVE-2007-6352.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Another integer overflow was found in the way libexif parses EXIF image tags. An individual who opened a carefully-crafted EXIF image file could cause the application linked against libexif to crash or possibly execute arbitrary code.

Updated packages have been patched to prevent this issue.

The remote host is affected by the vulnerability described in GLSA-200706-09 (libexif: Buffer overflow)

    iDefense Labs have discovered that the exif_data_load_data_entry()     function in libexif/exif-data.c improperly handles integer data while     working with an image with many EXIF components, allowing an integer     overflow possibly leading to a heap-based buffer overflow.
  Impact :

    An attacker could entice a user of an application making use of a     vulnerable version of libexif to load a specially crafted image file,     possibly resulting in a crash of the application or the execution of     arbitrary code with the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

New libexif packages are available for Slackware 10.2, 11.0, and
-current to fix a crash and potential security issue.

Sean Larsson discovered that libexif did not correctly verify the size of EXIF components. By tricking a user into opening an image with specially crafted EXIF headers, a remote attacker could cause the application using libexif to execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168)

ID	Name	Product	Family	Published	Updated	Severity
25589	Fedora Core 5 : libexif-0.6.12-5 (2007-605)	Nessus	Fedora Local Security Checks	6/27/2007	1/11/2021	medium
25619	Fedora Core 6 : libexif-0.6.15-2.fc6 (2007-614)	Nessus	Fedora Local Security Checks	6/29/2007	1/11/2021	medium
25532	Debian DSA-1310-1 : libexif - integer overflow	Nessus	Debian Local Security Checks	6/18/2007	1/4/2021	medium
67524	Oracle Linux 4 / 5 : libexif (ELSA-2007-0501)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
25540	RHEL 4 / 5 : libexif (RHSA-2007:0501)	Nessus	Red Hat Local Security Checks	6/18/2007	1/14/2021	medium
29762	Fedora 7 : libexif-0.6.15-3.fc7 (2007-4608)	Nessus	Fedora Local Security Checks	12/24/2007	1/11/2021	medium
25528	CentOS 4 / 5 : libexif (CESA-2007:0501)	Nessus	CentOS Local Security Checks	6/18/2007	1/4/2021	medium
25563	Mandrake Linux Security Advisory : libexif (MDKSA-2007:128)	Nessus	Mandriva Local Security Checks	6/21/2007	1/6/2021	medium
25594	GLSA-200706-09 : libexif: Buffer overflow	Nessus	Gentoo Local Security Checks	6/27/2007	1/6/2021	medium
25771	Slackware 10.2 / 11.0 / current : libexif (SSA:2007-164-01)	Nessus	Slackware Local Security Checks	7/27/2007	1/14/2021	medium
27666	Fedora 7 : libexif-0.6.15-2.fc7 (2007-0414)	Nessus	Fedora Local Security Checks	11/6/2007	1/11/2021	medium
28079	Ubuntu 6.06 LTS / 6.10 / 7.04 : libexif vulnerability (USN-478-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	medium
60210	Scientific Linux Security Update : libexif on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium