[SECURITY] [DLA 2439-1] libexif security update

2020-11-0713:53:40

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

79.7%

JSON

Debian LTS Advisory DLA-2439-1 [email protected]
https://www.debian.org/lts/security/ Utkarsh Gupta
November 07, 2020 https://wiki.debian.org/LTS

Package : libexif
Version : 0.6.21-2+deb9u5
CVE ID : CVE-2020-0452

In libexif/exif-entry.c, through libexif 0.6.21-2+deb9u4,
compiler optimization could remove a buffer overflow check,
making a buffer overflow possible with some EXIF tags.

For Debian 9 stretch, this problem has been fixed in version
0.6.21-2+deb9u5.

We recommend that you upgrade your libexif packages.

For the detailed security status of libexif please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libexif

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10arm64libexif12< 0.6.21-5.1+deb10u5libexif12_0.6.21-5.1+deb10u5_arm64.deb
Debian9armhflibexif12< 0.6.21-2+deb9u5libexif12_0.6.21-2+deb9u5_armhf.deb
Debian10i386libexif12< 0.6.21-5.1+deb10u5libexif12_0.6.21-5.1+deb10u5_i386.deb
Debian10mipsellibexif12-dbgsym< 0.6.21-5.1+deb10u5libexif12-dbgsym_0.6.21-5.1+deb10u5_mipsel.deb
Debian10arm64libexif12-dbgsym< 0.6.21-5.1+deb10u5libexif12-dbgsym_0.6.21-5.1+deb10u5_arm64.deb
Debian9armellibexif12< 0.6.21-2+deb9u5libexif12_0.6.21-2+deb9u5_armel.deb
Debian10i386libexif12-dbgsym< 0.6.21-5.1+deb10u5libexif12-dbgsym_0.6.21-5.1+deb10u5_i386.deb
Debian9amd64libexif-dev< 0.6.21-2+deb9u5libexif-dev_0.6.21-2+deb9u5_amd64.deb
Debian10armellibexif-dev< 0.6.21-5.1+deb10u5libexif-dev_0.6.21-5.1+deb10u5_armel.deb
Debian9armellibexif-dev< 0.6.21-2+deb9u5libexif-dev_0.6.21-2+deb9u5_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	arm64	libexif12	< 0.6.21-5.1+deb10u5	libexif12_0.6.21-5.1+deb10u5_arm64.deb
Debian	9	armhf	libexif12	< 0.6.21-2+deb9u5	libexif12_0.6.21-2+deb9u5_armhf.deb
Debian	10	i386	libexif12	< 0.6.21-5.1+deb10u5	libexif12_0.6.21-5.1+deb10u5_i386.deb
Debian	10	mipsel	libexif12-dbgsym	< 0.6.21-5.1+deb10u5	libexif12-dbgsym_0.6.21-5.1+deb10u5_mipsel.deb
Debian	10	arm64	libexif12-dbgsym	< 0.6.21-5.1+deb10u5	libexif12-dbgsym_0.6.21-5.1+deb10u5_arm64.deb
Debian	9	armel	libexif12	< 0.6.21-2+deb9u5	libexif12_0.6.21-2+deb9u5_armel.deb
Debian	10	i386	libexif12-dbgsym	< 0.6.21-5.1+deb10u5	libexif12-dbgsym_0.6.21-5.1+deb10u5_i386.deb
Debian	9	amd64	libexif-dev	< 0.6.21-2+deb9u5	libexif-dev_0.6.21-2+deb9u5_amd64.deb
Debian	10	armel	libexif-dev	< 0.6.21-5.1+deb10u5	libexif-dev_0.6.21-5.1+deb10u5_armel.deb
Debian	9	armel	libexif-dev	< 0.6.21-2+deb9u5	libexif-dev_0.6.21-2+deb9u5_armel.deb