Debian Libexif vulnerabilities

CVE-2026-32775 [HIGH] CVE-2026-32775: libexif - libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data... libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2020-0452 [CRITICAL] CVE-2020-0452: libexif - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write... In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Andr

CVE-2020-0181 [HIGH] CVE-2020-0181: libexif - In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of s... In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076 Scope: local bookworm: resolved (fixed in 0.6.21-6) bul

CVE-2020-13113 [HIGH] CVE-2020-13113: libexif - An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in... An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions. Scope: local bookworm: resolved (fixed in 0.6.21-9) bullseye: resolved (fixed in 0.6.21-9) forky: resolved (fixed in 0.6.21-9) sid: resolved (fixed in 0.6.21-9) trixie: resolved (fixed in 0.6.21-9)

CVE-2020-13114 [HIGH] CVE-2020-13114: libexif - An issue was discovered in libexif before 0.6.22. An unrestricted size in handli... An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data. Scope: local bookworm: resolved (fixed in 0.6.21-9) bullseye: resolved (fixed in 0.6.21-9) forky: resolved (fixed in 0.6.21-9) sid: resolved (fixed in 0.6.21-9) trixie: resolve

CVE-2020-0198 [HIGH] CVE-2020-0198: libexif - In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort d... In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941 Scope: local bookworm: resolved (fixed in 0.6.22-2) bullseye: resol

CVE-2020-0093 [MEDIUM] CVE-2020-0093: libexif - In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds r... In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148705132 Scope: local bookwo

CVE-2020-13112 [MEDIUM] CVE-2020-13112: libexif - An issue was discovered in libexif before 0.6.22. Several buffer over-reads in E... An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093. Scope: local bookworm: resolved (fixed in 0.6.21-9) bullseye: resolved (fixed in 0.6.21-9) forky: resolved (fixed in 0.6.21-9) sid: resolved (fixed in 0.6.21-9) trixie: resolv

CVE-2020-12767 [MEDIUM] CVE-2020-12767: libexif - exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero erro... exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. Scope: local bookworm: resolved (fixed in 0.6.21-7) bullseye: resolved (fixed in 0.6.21-7) forky: resolved (fixed in 0.6.21-7) sid: resolved (fixed in 0.6.21-7) trixie: resolved (fixed in 0.6.21-7)

CVE-2020-0182 [MEDIUM] CVE-2020-0182: libexif - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read ... In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917 Scope: local bookworm: resolved (fixed in 0.6.22-1) b

CVE-2019-9278 [HIGH] CVE-2019-9278: libexif - In libexif, there is a possible out of bounds write due to an integer overflow. ... In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774 Scope: local bookworm: resolved (fixed in 0.6.21-6) bulls

CVE-2018-20030 [HIGH] CVE-2018-20030: libexif - An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags wi... An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources. Scope: local bookworm: resolved (fixed in 0.6.21-5.1) bullseye: resolved (fixed in 0.6.21-5.1) forky: resolved (fixed in 0.6.21-5.1) sid: resolved (fixed in 0.6.21-5.1) trixie: resolved (fixed in 0.6.21-5.1)

CVE-2017-7544 [CRITICAL] CVE-2017-7544: libexif - libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in... libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure. Scope: local bookworm: resolved (fixed in 0.6.21-2.1) bullseye: resolved (f

CVE-2016-6328 [HIGH] CVE-2016-6328: libexif - A vulnerability was found in libexif. An integer overflow when parsing the MNOTE... A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data). Scope: local bookworm: resolved (fixed in 0.6.21-2.1) bullseye: resolved (fixed in 0.6.21-2.1) forky: reso

CVE-2012-2840 [HIGH] CVE-2012-2840: libexif - Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in t... Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image. Scope: local bookworm: resolved (fixed in 0.6.20-3) bullseye: resolved (fixed in 0.6.20-3) forky: resolved (fix

CVE-2012-2814 [HIGH] CVE-2012-2814: libexif - Buffer overflow in the exif_entry_format_value function in exif-entry.c in the E... Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image. Scope: local bookworm: resolved (fixed in 0.6.20-3) bullseye: resolved (fixed in 0.6.20-3) forky: resolved (fixed in 0.6.2

CVE-2012-2841 [HIGH] CVE-2012-2841: libexif - Integer underflow in the exif_entry_get_value function in exif-entry.c in the EX... Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 might allow remote attackers to execute arbitrary code via vectors involving a crafted buffer-size parameter during the formatting of an EXIF tag, leading to a heap-based buffer overflow. Scope: local bookworm: resolved (fixed in 0.6.20-3) bullse

CVE-2012-2837 [MEDIUM] CVE-2012-2837: libexif - The mnote_olympus_entry_get_value function in olympus/mnote-olympus-entry.c in t... The mnote_olympus_entry_get_value function in olympus/mnote-olympus-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (divide-by-zero error) via an image with crafted EXIF tags that are not properly handled during the formatting of EXIF maker note tags. Scope: local bookworm: resolved (fixed in 0

CVE-2012-2812 [MEDIUM] CVE-2012-2812: libexif - The exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Librar... The exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image. Scope: local bookworm: resolved (fixed in 0.6.20-3) bullseye: resolved (fixed in 0.6.20-

CVE-2012-2836 [MEDIUM] CVE-2012-2836: libexif - The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library ... The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image. Scope: local bookworm: resolved (fixed in 0.6.20-3) bullseye: resolved (fixed in 0.6.20-3)