Red Hat Security Advisory: libexif security, bug fix, and enhancement update

Fixed packages 6

Vulnerabilities 8

• Unscored —
  CVE-2019-9278

  In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of…

  libexif libexif libexif Android Debian Ubuntu Alpine
  Sep 27, 2019
• Unscored —
  CVE-2020-0093

  In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This…

  libexif libexif sleuthkit libexif Android Debian Ubuntu Alpine
  May 14, 2020
• Unscored —
  CVE-2020-0181 Public exploit

  In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This…

  libexif Android Debian
  Jun 11, 2020
• Unscored —
  CVE-2020-0182

  In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This cou…

  libexif libexif Android Debian Ubuntu
  Jun 11, 2020
• Unscored —
  CVE-2020-0198 Public exploit

  In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could l…

  libexif libexif libexif Android Debian Ubuntu Alpine
  Jun 11, 2020
• Unscored —
  CVE-2020-12767

  exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error.

  libexif libexif libexif Debian Ubuntu Alpine
  May 9, 2020
• Unscored —
  CVE-2020-13113

  An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to …

  libexif libexif libexif Debian Ubuntu Alpine
  May 21, 2020
• Unscored —
  CVE-2020-13114

  An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead…

  libexif libexif libexif Debian Ubuntu Alpine
  May 21, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1789031
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1834950
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1840347
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1840350
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1841320
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1847131
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1847133
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1852487
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1852490
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4766.json
• report
  https://access.redhat.com/security/cve/CVE-2019-9278
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9278
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9278
• report
  https://access.redhat.com/security/cve/CVE-2020-0093
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-0093
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-0093
• report
  https://access.redhat.com/security/cve/CVE-2020-0181
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-0181
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-0181
• report
  https://access.redhat.com/security/cve/CVE-2020-0182
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-0182
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-0182
• report
  https://access.redhat.com/security/cve/CVE-2020-0198
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-0198
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-0198
• report
  https://access.redhat.com/security/cve/CVE-2020-12767
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12767
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12767
• report
  https://access.redhat.com/security/cve/CVE-2020-13113
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-13113
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-13113
• report
  https://access.redhat.com/security/cve/CVE-2020-13114
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-13114
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-13114