PT-2020-1267 · Libexif+6 · Libexif+6

Published 2020-05-16 · Updated 2024-06-15 · CVE-2020-13113

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions libexif versions prior to 0.6.22

Description The issue is related to the use of uninitialized memory in EXIF Makernote handling, which could lead to crashes and potential use-after-free conditions. This could allow a remote attacker to access confidential data and cause a denial of service.

Recommendations For versions prior to 0.6.22, update to version 0.6.22 or later to resolve the issue. As a temporary workaround, consider restricting the use of EXIF Makernote handling until a patch is available.

Fix

Use of Uninitialized Resource

Use After Free

Weakness Enumeration

CWE-908

CWE-416

Related Identifiers

ALT-PU-2020-2019

ALT-PU-2020-2723

ASB-A-196085005

BDU:2021-03724

CESA-2020_4040

CESA-2020_4766

CVE-2020-13113

DLA-2222-1

MGASA-2020-0238

OESA-2021-1286

OPENSUSE-SU-2020:0793-1

OPENSUSE-SU-2020_0793-1

OPENSUSE-SU-2024:10939-1

RHSA-2020:4040

RHSA-2020:4766

RHSA-2020_4040

RHSA-2020_4766

SUSE-SU-2020:1534-1

SUSE-SU-2020:1553-1

SUSE-SU-2020:1553-2

SUSE-SU-2020_1534-1

SUSE-SU-2020_1553-1

SUSE-SU-2020_1553-2

USN-4396-1

Affected Products

Alt Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Libexif

References · 73

• https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f · Patch
• https://osv.dev/vulnerability/OESA-2021-1286 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13113 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-0198 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1553-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13113 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10939-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4396-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13113 · Vendor Advisory
• https://usn.ubuntu.com/4396-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03724 · Security Note
• https://security.gentoo.org/glsa/202007-05 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=47416144 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13113 · Vendor Advisory