media-gfx/exif-0.6.22-r2 — Security Advisories

portage-ng glsa

▸ GLSA 202210-28 exif: Denial of Service this version unaffected low remote 2022-10-31

A vulnerability has been discovered in exif which could result in denial of service.

Announced: 2022-10-31
Revised: 2022-10-31
Access: remote
Bugs: #783522
Advisory: https://security.gentoo.org/glsa/202210-28

Affected packages

Package	Arch	Vulnerable	Unaffected
media-gfx/exif	*	< 0.6.22	>= 0.6.22

Background

libexif is a library for parsing, editing and saving Exif metadata from images. exif is a small command line interface for libexif.

Description

There is a bug in exif's XML output format which can result in a null pointer dereference when outputting crafted JPEG EXIF data.

Impact

A crafted JPEG image can trigger a denial of service in the form of a null pointer dereference.

Workaround

There is no known workaround at this time.

Resolution

All exif users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/exif-0.6.22"

References

CVE-2021-27815

▸ GLSA 201401-10 libexif, exif: Multiple vulnerabilities this version unaffected normal remote 2014-01-19

Multiple vulnerabilities have been found in libexif and exif, some of which may allow execution of arbitrary code.

Announced: 2014-01-19
Revised: 2014-01-19
Access: remote
Bugs: #426366
Advisory: https://security.gentoo.org/glsa/201401-10

Affected packages

Package	Arch	Vulnerable	Unaffected
media-gfx/exif	*	< 0.6.21	>= 0.6.21
media-libs/libexif	*	< 0.6.21	>= 0.6.21

Background

libexif is a library for parsing, editing and saving Exif metadata from images. exif is a small command line interface for libexif.

Description

Multiple vulnerabilities have been discovered in libexif and exif. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user to open a specially crafted image file using exif or an application linked against libexif, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All libexif users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/libexif-0.6.21"

Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.

All exif users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/exif-0.6.21"