Bug 1902004 (CVE-2020-0452) - CVE-2020-0452 libexif: out of bounds write due to an integer overflow in exif-entry.c
Summary: CVE-2020-0452 libexif: out of bounds write due to an integer overflow in exif...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-0452
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1902005 1902588 1902589 1902590 1902591 1902592 1902593 1902594
Blocks: 1902006
TreeView+ depends on / blocked
 
Reported: 2020-11-26 15:05 UTC by Marian Rehak
Modified: 2024-03-25 17:15 UTC (History)
11 users (show)

Fixed In Version: libexif 0.6.22.1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in libexif. A possible out of bounds write, due ot an integer overflow, could lead to a remote code execution if a third party app used this library to process remote image data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2020-12-14 12:47:04 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:5393 0 None None None 2020-12-14 11:43:36 UTC
Red Hat Product Errata RHSA-2020:5394 0 None None None 2020-12-14 11:47:30 UTC
Red Hat Product Errata RHSA-2020:5395 0 None None None 2020-12-14 11:42:19 UTC
Red Hat Product Errata RHSA-2020:5396 0 None None None 2020-12-14 11:34:36 UTC
Red Hat Product Errata RHSA-2020:5402 0 None None None 2020-12-14 13:31:57 UTC

Description Marian Rehak 2020-11-26 15:05:39 UTC 
In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-159625731

References:

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ELDZR6USD5PR34MRK2ZISLCYJ465FNKN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVBD5JRUQPN4LQHTAAJHA3MR5M7YTAC7/
https://security.gentoo.org/glsa/202011-19
Comment 1 Marian Rehak 2020-11-26 15:06:05 UTC 
Created libexif tracking bugs for this issue:

Affects: fedora-all [bug 1902005]
Comment 2 Huzaifa S. Sidhpurwala 2020-11-30 06:26:51 UTC 
Upstream commit: 
https://github.com/libexif/libexif/commit/9266d14b5ca4e29b970fa03272318e5f99386e06#diff-7ee66c4f1536ac84dc5bbff1b8312e2eef24b974b3e48a5c5c2bcfdf2eb8f3ce
Comment 4 errata-xmlrpc 2020-12-14 11:34:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:5396 https://access.redhat.com/errata/RHSA-2020:5396
Comment 5 errata-xmlrpc 2020-12-14 11:42:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:5395 https://access.redhat.com/errata/RHSA-2020:5395
Comment 6 errata-xmlrpc 2020-12-14 11:43:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:5393 https://access.redhat.com/errata/RHSA-2020:5393
Comment 7 errata-xmlrpc 2020-12-14 11:47:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2020:5394 https://access.redhat.com/errata/RHSA-2020:5394
Comment 8 Product Security DevOps Team 2020-12-14 12:47:04 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-0452
Comment 9 errata-xmlrpc 2020-12-14 13:31:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:5402 https://access.redhat.com/errata/RHSA-2020:5402
Note You need to log in before you can comment on or make changes to this bug.