Division by zero in libexif - CVE-2012-2837

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU31850

Division by zero in libexif - CVE-2012-2837

Published: July 26, 2020


Vulnerability identifier: #VU31850
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-2837
CWE-ID: CWE-369
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to divide-by-zero error within the mnote_olympus_entry_get_value function in olympus/mnote-olympus-entry.c in the EXIF Tag Parsing Library. A remote attacker can perform a denial of service (divide-by-zero error) via an image with crafted EXIF tags that are not properly handled during the formatting of EXIF maker note tags.


Affected software

libexif
Gentoo Linux
Amazon Linux AMI
SUSE Linux
Slackware Linux
libexif (Alpine package)

How to mitigate CVE-2012-2837

Install update from vendor's website.

libexif - update to 0.6.21
libexif (Alpine package) - update to 0.6.21-r0

External References

Related Security Bulletins