Veracode Vulnerability DatabaseVERACODE:25721Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
libexif.so is vulnerable to denial of service. The vulnerability exists because the function exif_data_load_data_content in exif-data.c does not handle the UBSAN abort due to an integer overflow which allows an attacker to cause an application crash.
References
github.com/libexif/libexif/commit/ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c
lists.debian.org/debian-lts-announce/2020/06/msg00020.html
lists.fedoraproject.org/archives/list/[email protected]/message/ELDZR6USD5PR34MRK2ZISLCYJ465FNKN/
lists.fedoraproject.org/archives/list/[email protected]/message/SVBD5JRUQPN4LQHTAAJHA3MR5M7YTAC7/
security.gentoo.org/glsa/202011-19
source.android.com/security/bulletin/pixel/2020-06-01
usn.ubuntu.com/4396-1/
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P