Red Hat Security AdvisoryRHSA-2020:4766
libexif security, bug fix, and enhancement update
Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder (v. 8) libexif-devel-0.6.22-4.el8
- Red Hat Enterprise Linux AppStream (v. 8) libexif-0.6.22-4.el8
Fixes 8 records
Priority MEDIUM 45
In libexif, there is a possible out of bounds write due to an integer overflow.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.04059 · Published 2019-09-27 · Partial fix CWE-190
Priority MEDIUM 40
In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04262 · Published 2020-06-11 · Partial fix CWE-190
Priority LOW 39
An issue was discovered in libexif before 0.6.22.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.01934 · Published 2020-05-21 · Partial fix CWE-908
Priority LOW 38
In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02856 · Published 2020-06-11 · Partial fix CWE-190
Priority LOW 37
An issue was discovered in libexif before 0.6.22.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02359 · Published 2020-05-21 · Partial fix CWE-770
Priority LOW 31
In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01134 · Published 2020-06-11 · Partial fix CWE-125
Priority LOW 25
exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00531 · Published 2020-05-09 · Partial fix CWE-369
Priority LOW 23
In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check.
CVSS 3.1MEDIUM 5.0· Local · Low privileges · User interaction · EPSS 0.00301 · Published 2020-05-14 · Partial fix CWE-125