Out-of-bounds read in libexif - CVE-2012-2845
Published: July 26, 2020
Vulnerability identifier: #VU31847
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-2845
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in Integer overflow in the jpeg_data_load_data function in jpeg-data.c in libjpeg in exif 0.6.20. A remote attacker can perform a denial of service (buffer over-read and application crash) or obtain potentially sensitive information via a crafted JPEG file.
Affected software
libexif
Gentoo Linux
Slackware Linux
libexif (Alpine package)
Gentoo Linux
Slackware Linux
libexif (Alpine package)
How to mitigate CVE-2012-2845
Install update from vendor's website.
libexif - update to 0.6.21
libexif (Alpine package) - update to 0.6.22-r0
libexif (Alpine package) - update to 0.6.22-r0