Bug 839182 (CVE-2012-2813)
| Summary: | CVE-2012-2813 libexif: "exif_convert_utf16_to_utf8()" heap-based out-of-bounds array read | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Stefan Cornelius <scorneli> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | jrusnack, rhughes, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | libexif 0.6.21 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-08-22 03:25:52 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 839913, 839914, 839915, 839916, 839917 | ||
| Bug Blocks: | 839036 | ||
|
Description
Stefan Cornelius
2012-07-11 07:29:14 UTC
This now public via exif 0.6.21: http://libexif.cvs.sourceforge.net/viewvc/libexif/libexif/ChangeLog?revision=1.370 http://libexif.cvs.sourceforge.net/viewvc/libexif/libexif/libexif/exif-entry.c?r1=1.146&r2=1.147&view=patch Created libexif tracking bugs for this issue Affects: fedora-all [bug 839917] Upstream advisory: http://sourceforge.net/mailarchive/message.php?msg_id=29534027 Acknowledgements: Red Hat would like to thank Dan Fandrich for reporting this issue. Upstream acknowledges Mateusz Jurczyk of the Google Security Team as the original reporter. This issue has been addressed in following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Via RHSA-2012:1255 https://rhn.redhat.com/errata/RHSA-2012-1255.html libexif-0.6.21-2.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. libexif-0.6.21-2.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. |