Off-by-one in libexif - CVE-2012-2840

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU31849

Off-by-one in libexif - CVE-2012-2840

Published: July 26, 2020


Vulnerability identifier: #VU31849
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2012-2840
CWE-ID: CWE-193
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: libexif.sourceforge.net
Affected software:
libexif

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library. A remote attacker can trigger an off-by-one error via crafted EXIF tags in an image and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


How to mitigate CVE-2012-2840

Install update from vendor's website.

Sources