Multiple vulnerabilities have been found in libexif, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libexif | * | < 0.6.22_p20201105 | >= 0.6.22_p20201105 |
libexif is a library for parsing, editing and saving Exif metadata from images.
Multiple vulnerabilities have been discovered in libexif. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libexif users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libexif-0.6.22_p20201105"
Multiple vulnerabilities have been found in libexif, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libexif | * | < 0.6.22 | >= 0.6.22 |
libexif is a library for parsing, editing and saving Exif metadata from images.
Multiple vulnerabilities have been discovered in libexif. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libexif users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libexif-0.6.22"
Multiple vulnerabilities have been found in libexif and exif, some of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/exif | * | < 0.6.21 | >= 0.6.21 |
| media-libs/libexif | * | < 0.6.21 | >= 0.6.21 |
libexif is a library for parsing, editing and saving Exif metadata from images. exif is a small command line interface for libexif.
Multiple vulnerabilities have been discovered in libexif and exif. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted image file using exif or an application linked against libexif, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All libexif users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libexif-0.6.21"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.
All exif users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/exif-0.6.21"
Two vulnerabilities in libexif possibly allow for the execution of arbitrary code or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libexif | * | < 0.6.16-r1 | >= 0.6.16-r1 |
libexif is a library for parsing, editing and saving Exif metadata from images. Exif, the Exchangeable image file format, specifies the addition of metadata tags to JPEG, TIFF and RIFF files.
Meder Kydyraliev (Google Security) discovered an integer overflow vulnerability in the exif_data_load_data_thumbnail() function leading to a memory corruption (CVE-2007-6352) and an infinite recursion in the exif_loader_write() function (CVE-2007-6351).
An attacker could entice the user of an application making use of libexif to load an image file with specially crafted Exif tags, possibly resulting in the execution of arbitrary code with the privileges of the user running the application or a Denial of Service.
There is no known workaround at this time.
All libexif users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libexif-0.6.16-r1"
libexif does not properly handle image EXIF information, possibly allowing for the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libexif | * | < 0.6.16 | >= 0.6.16 |
libexif is a library for parsing, editing and saving EXIF metadata from images.
iDefense Labs have discovered that the exif_data_load_data_entry() function in libexif/exif-data.c improperly handles integer data while working with an image with many EXIF components, allowing an integer overflow possibly leading to a heap-based buffer overflow.
An attacker could entice a user of an application making use of a vulnerable version of libexif to load a specially crafted image file, possibly resulting in a crash of the application or the execution of arbitrary code with the rights of the user running the application.
There is no known workaround at this time.
All libexif users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libexif-0.6.16"
libexif fails to handle Exif (EXchangeable Image File) data inputs, making it vulnerable to an integer overflow.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libexif | * | < 0.6.15 | >= 0.6.15 |
libexif is a library for parsing, editing and saving Exif data.
Victor Stinner reported an integer overflow in the exif_data_load_data_entry() function from file exif-data.c while handling Exif data.
An attacker could entice a user to process a file with specially crafted Exif extensions with an application making use of libexif, which will trigger the integer overflow and potentially execute arbitrary code or crash the application.
There is no known workaround at this time.
All libexif users should upgrade to the latest version. Please note that users upgrading from "<=media-libs/libexif-0.6.13" should also run revdep-rebuild after their upgrade.
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libexif-0.6.15" # revdep-rebuild --library=/usr/lib/libexif.so
libexif fails to validate certain inputs, making it vulnerable to buffer overflows.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libexif | * | < 0.5.12-r1 | >= 0.5.12-r1 |
libexif is a library for parsing, editing and saving EXIF data.
libexif contains a buffer overflow vulnerability in the EXIF tag validation code. When opening an image with a specially crafted EXIF tag, the lack of validation can cause applications linked to libexif to crash.
A specially crafted EXIF file could crash applications making use of libexif, potentially allowing the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All libexif users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libexif-0.5.12-r1"