CVE-2012-2836

2012-07-1310:34:59

CWE-119

[email protected]

web.nvd.nist.gov

cve-2012-2836

exif data load data

libexif

out-of-bounds read

denial of service

sensitive information

nvd

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

6.6 Medium

AI Score

Confidence

High

0.033 Low

EPSS

Percentile

91.4%

JSON

The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.

Affected configurations

NVD

Node

libexif_projectlibexifRange≤0.6.20

libexif_projectlibexifMatch0.6.14

libexif_projectlibexifMatch0.6.15

libexif_projectlibexifMatch0.6.16

libexif_projectlibexifMatch0.6.18

libexif_projectlibexifMatch0.6.19

CPENameOperatorVersion
libexif_project:libexiflibexif project libexifle0.6.20
libexif_project:libexiflibexif project libexifeq0.6.14
libexif_project:libexiflibexif project libexifeq0.6.15
libexif_project:libexiflibexif project libexifeq0.6.16
libexif_project:libexiflibexif project libexifeq0.6.18
libexif_project:libexiflibexif project libexifeq0.6.19

CPE	Name	Operator	Version
libexif_project:libexif	libexif project libexif	le	0.6.20
libexif_project:libexif	libexif project libexif	eq	0.6.14
libexif_project:libexif	libexif project libexif	eq	0.6.15
libexif_project:libexif	libexif project libexif	eq	0.6.16
libexif_project:libexif	libexif project libexif	eq	0.6.18
libexif_project:libexif	libexif project libexif	eq	0.6.19