A heap-based out-of-bounds array read in the exif_entry_get_value function in libexif/exif-entry.c in libexif 0.6.20 and earlier allows remote attackers to cause a denial of service or possibly obtain potentially sensitive information from process memory via an image with crafted EXIF tags.
This now public via exif 0.6.21: http://libexif.cvs.sourceforge.net/viewvc/libexif/libexif/ChangeLog?revision=1.370 http://libexif.cvs.sourceforge.net/viewvc/libexif/libexif/libexif/exif-entry.c?r1=1.147&r2=1.148&view=patch
Created libexif tracking bugs for this issue Affects: fedora-all [bug 839917]
Acknowledgements: Red Hat would like to thank Dan Fandrich for reporting this issue. Upstream acknowledges Mateusz Jurczyk of the Google Security Team as the original reporter.
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Via RHSA-2012:1255 https://rhn.redhat.com/errata/RHSA-2012-1255.html
libexif-0.6.21-2.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
libexif-0.6.21-2.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.