Lucene search

RedhatCVE-2009-3895

HistoryNov 20, 2009 - 6:30 p.m.

CVE-2009-3895

2009-11-2018:30:00

CWE-119

redhat

web.nvd.nist.gov

cve-2009-3895

heap-based buffer overflow

exif_entry_fix function

libexif

denial of service

arbitrary code

nvd

security vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

8.2

Confidence

High

EPSS

0.051

Percentile

93.0%

JSON

Heap-based buffer overflow in the exif_entry_fix function (aka the tag fixup routine) in libexif/exif-entry.c in libexif 0.6.18 allows remote attackers to cause a denial of service or possibly execute arbitrary code via an invalid EXIF image. NOTE: some of these details are obtained from third party information.

Affected configurations

Nvd

Node

libexif_projectlibexifMatch0.6.18

VendorProductVersionCPE
libexif_projectlibexif0.6.18cpe:2.3:a:libexif_project:libexif:0.6.18:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libexif_project	libexif	0.6.18	cpe:2.3:a:libexif_project:libexif:0.6.18:::::::*

References

bugs.debian.org/557137

bugs.gentoo.org/show_bug.cgi?id=293190

libexif.cvs.sourceforge.net/viewvc/libexif/libexif/NEWS?view=markup&pathrev=libexif-0_6_19-release

secunia.com/advisories/37378

sourceforge.net/mailarchive/message.php?msg_name=20091113072359.GA22681%40coneharvesters.com

www.openwall.com/lists/oss-security/2009/11/19/2

www.osvdb.org/59956

www.securityfocus.com/bid/37022

www.vupen.com/english/advisories/2009/3243

exchange.xforce.ibmcloud.com/vulnerabilities/54275

Social References

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

8.2

Confidence

High

EPSS

0.051

Percentile

93.0%

JSON

Related for CVE-2009-3895