PT-2019-5083 · None+6 · Libexif+6

Msmeissn · Published 2019-09-27 · Updated 2024-06-15 · CVE-2019-9278

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libexif (affected versions not specified) Android versions Android-10

Description The issue is caused by an integer overflow in the libexif library, which is used for parsing EXIF files. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability may lead to remote escalation of privilege in the media content provider. User interaction is required for exploitation.

Recommendations For libexif, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Android versions Android-10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

ALT-PU-2020-2019

ALT-PU-2020-2723

BDU:2020-01749

CESA-2020_4040

CESA-2020_4766

CVE-2019-9278

DLA-2100-1

DSA-4618-1

MGASA-2019-0331

OESA-2022-2006

OESA-2022-2008

OPENSUSE-SU-2020:0264-1

OPENSUSE-SU-2020:0793-1

OPENSUSE-SU-2020_0264-1

OPENSUSE-SU-2020_0793-1

OPENSUSE-SU-2024:10939-1

RHSA-2020:4040

RHSA-2020:4766

RHSA-2020_4040

RHSA-2020_4766

SUSE-SU-2020:0457-1

SUSE-SU-2020:0458-1

SUSE-SU-2020:14294-1

SUSE-SU-2020:1534-1

SUSE-SU-2020:1553-1

SUSE-SU-2020:1553-2

SUSE-SU-2020_1534-1

SUSE-SU-2020_1553-1

SUSE-SU-2020_1553-2

USN-4277-1

Affected Products

Alt Linux

Android

Centos

Red Hat

Suse

Ubuntu

Libexif

References · 86

• https://github.com/libexif/libexif/issues/26 · Patch
• https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566 · Patch
• https://debian.org/security/2020/dsa-4618 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2008 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-9278 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO2VTHD7OLPJDCJBHKUQTBAHZOBBCF6X · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0793-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4618-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9278 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:14294-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0457-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0331.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-0198 · Security Note
• https://usn.ubuntu.com/4277-1 · Vendor Advisory