CVE-2019-11927

An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via specially-crafted EXIF tags in WEBP images. This issue affects WhatsApp for Android before version 2.19.143 and WhatsApp for iOS before version 2.19.100...

CVE-2019-11927

CVE-2019-11927 is an integer overflow in WhatsApp media parsing libraries that enables a remote attacker to trigger an out-of-bounds write on the heap via specially crafted EXIF tags in WEBP images. Affected: WhatsApp for Android prior to 2.19.143 and WhatsApp for iOS prior to 2.19.100. Impact de...

CVE-2019-11927: Integer Overflow or Wraparound

An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via specially-crafted EXIF tags in WEBP images. This issue affects WhatsApp for Android before version 2.19.143 and WhatsApp for iOS before version 2.19.100...

EulerOS 2.0 SP3 : libexif (EulerOS-SA-2019-2036)

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows...

[SECURITY] [DSA 4529-1] php7.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4529-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 20, 2019 https://www.debian.org/security/faq -...

Pixload - Image Payload Creating/Injecting Tools

Set of tools for creating/injecting payload into images. SETUP The following Perl modules are required: - GD - Image::ExifTool - String::CRC32 On Debian-based systems install these packages: sudo apt install libgd-perl libimage-exiftool-perl libstring-crc32-perl On OSX please refer to this...

[SECURITY] [DSA 4527-1] php7.3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4527-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 19, 2019 https://www.debian.org/security/faq -...

Amazon Linux AMI : php71 / php73 (ALAS-2019-1283)

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information...

Amazon Linux AMI : php71 / php72,php73 (ALAS-2019-1282)

An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to...

Amazon Linux AMI : php72 (ALAS-2019-1284)

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information...

EulerOS 2.0 SP2 : libexif (EulerOS-SA-2019-1850)

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows...

CVE-2019-15740

An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads...

CVE-2019-15740

An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads...

CVE-2019-15740

An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads...

Code injection

An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads...

CVE-2019-15740

An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads...

CVE-2019-15740

GitLab CE/EE versions 7.9–12.2.1 are affected by CVE-2019-15740 due to EXIF geolocation data not being removed from certain image uploads, enabling disclosure of location metadata. Root cause: failure to strip EXIF data during uploads. Impact: potential exposure of geolocation information. Mitiga...

CVE-2019-15740

Removed by vendor...

CVE-2019-15740: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads...

php:php-fuzz-exif: Heap-buffer-overflow in php_ifd_get32u

Detailed Report: https://oss-fuzz.com/testcase?key=5720780498796544 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60400002f9f9 Crash State: phpifdget32u exifconvertanytoint...