A buffer overflow in the exif_entry_format_value function in libexif/exif-entry.c in libexif 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via an image with crafted EXIF tags.
This now public via exif 0.6.21:
Created libexif tracking bugs for this issue
Affects: fedora-all [bug 839917]
Red Hat would like to thank Dan Fandrich for reporting this issue. Upstream acknowledges Mateusz Jurczyk of the Google Security Team as the original reporter.
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 5
Via RHSA-2012:1255 https://rhn.redhat.com/errata/RHSA-2012-1255.html
libexif-0.6.21-2.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
libexif-0.6.21-2.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.