Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-0452: A flaw was found in libexif. A possible out of bounds write, due ot an integer overflow, could lead to a remote code execution if a third party app used this library to process remote image data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1902004: CVE-2020-0452 libexif: out of bounds write due to an integer overflow in exif-entry.c
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libexif | 0:0.6.22-2.amzn2 |
| Amazon Linux · 2 | libexif-debuginfo | 0:0.6.22-2.amzn2 |
| Amazon Linux · 2 | libexif-devel | 0:0.6.22-2.amzn2 |
| Amazon Linux · 2 | libexif-doc | 0:0.6.22-2.amzn2 |
Vulnerabilities 1
-
Unscored —CVE-2020-0452 Public exploit
In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-0452.html