PT-2020-6254 · Libexif+6 · Libexif+6

Published 2020-05-16 · Updated 2024-06-15 · CVE-2020-13114

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libexif versions prior to 0.6.22

Description The issue is related to an unrestricted size in handling Canon EXIF MakerNote data, which could lead to consumption of large amounts of compute time for decoding EXIF data. This could allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 0.6.22, update to version 0.6.22 or later to resolve the issue. As a temporary workaround, consider restricting the handling of Canon EXIF MakerNote data to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

ALT-PU-2020-2019

ALT-PU-2020-2723

BDU:2021-03725

CESA-2020_4040

CESA-2020_4766

CVE-2020-13114

DLA-2222-1

MGASA-2020-0238

OESA-2021-1286

OPENSUSE-SU-2020:0793-1

OPENSUSE-SU-2020_0793-1

OPENSUSE-SU-2024:10939-1

RHSA-2020:4040

RHSA-2020:4766

RHSA-2020_4040

RHSA-2020_4766

SUSE-SU-2020:1534-1

SUSE-SU-2020:1553-1

SUSE-SU-2020:1553-2

SUSE-SU-2020_1534-1

SUSE-SU-2020_1553-1

SUSE-SU-2020_1553-2

USN-4396-1

Affected Products

Alt Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Libexif

References · 72

• https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab · Patch
• https://osv.dev/vulnerability/USN-4396-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4040.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0793-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0238 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4396-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1534-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13113 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-0198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13114 · Security Note
• https://osv.dev/vulnerability/DLA-2222-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13114 · Security Note