An update for libexif is now available for openEuler-20.03-LTS-SP1
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2022-2008
Final
1.0
1.0
2022-10-21
Initial
2022-10-21
2022-10-21
openEuler SA Tool V1.0
2022-10-21
libexif security update
An update for libexif is now available for openEuler-20.03-LTS-SP1.
Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows you to parse an EXIF file and read the data from those tags.
Security Fix(es):
In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774(CVE-2019-9278)
In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148705132(CVE-2020-0093)
In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076(CVE-2020-0181)
In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941(CVE-2020-0198)
An update for libexif is now available for openEuler-20.03-LTS-SP1.
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
High
libexif
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2008
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2019-9278
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2020-0093
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2020-0181
https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2020-0198
https://nvd.nist.gov/vuln/detail/CVE-2019-9278
https://nvd.nist.gov/vuln/detail/CVE-2020-0093
https://nvd.nist.gov/vuln/detail/CVE-2020-0181
https://nvd.nist.gov/vuln/detail/CVE-2020-0198
openEuler-20.03-LTS-SP1
libexif-devel-0.6.21-25.oe1.aarch64.rpm
libexif-debuginfo-0.6.21-25.oe1.aarch64.rpm
libexif-debugsource-0.6.21-25.oe1.aarch64.rpm
libexif-0.6.21-25.oe1.aarch64.rpm
libexif-help-0.6.21-25.oe1.noarch.rpm
libexif-0.6.21-25.oe1.src.rpm
libexif-devel-0.6.21-25.oe1.x86_64.rpm
libexif-debugsource-0.6.21-25.oe1.x86_64.rpm
libexif-debuginfo-0.6.21-25.oe1.x86_64.rpm
libexif-0.6.21-25.oe1.x86_64.rpm
In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774
2022-10-21
CVE-2019-9278
openEuler-20.03-LTS-SP1
High
8.8
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
libexif security update
2022-10-21
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2008
In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148705132
2022-10-21
CVE-2020-0093
openEuler-20.03-LTS-SP1
Medium
5.0
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
libexif security update
2022-10-21
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2008
In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076
2022-10-21
CVE-2020-0181
openEuler-20.03-LTS-SP1
High
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
libexif security update
2022-10-21
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2008
In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941
2022-10-21
CVE-2020-0198
openEuler-20.03-LTS-SP1
High
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
libexif security update
2022-10-21
https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2008