Bug 1172766 – VUL-1: CVE-2020-0182: libexif: buffer read overflow in exif_entry_get_value

Bug 1172766 - (CVE-2020-0182) VUL-1: CVE-2020-0182: libexif: buffer read overflow in exif_entry_get_value

(CVE-2020-0182)
Summary:	VUL-1: CVE-2020-0182: libexif: buffer read overflow in exif_entry_get_value

Status:	NEW

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Minor
Target Milestone:	---
Assigned To:	Marcus Meissner
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/261183/
Whiteboard:	CVSSv3.1:SUSE:CVE-2020-0182:5.3:(AV:N...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2020-06-10 08:44 UTC by Wolfgang Frisch
Modified:	2020-06-10 12:00 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Wolfgang Frisch 2020-06-10 08:44:09 UTC

CVE-2020-0182

In exiv2, while parsing EXIF_TAG_FOCAL_LENGTH, it was possible to read 8 bytes past the end of a heap buffer.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0182
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-0182
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-0182.html

Comment 1 Wolfgang Frisch 2020-06-10 08:44:19 UTC

Upstream commit:
https://github.com/libexif/libexif/commit/f9bb9f263fb00f0603ecbefa8957cad24168cbff

Comment 2 Marcus Meissner 2020-06-10 08:47:06 UTC

actually libexif, not exiv2

Comment 3 Marcus Meissner 2020-06-10 08:48:15 UTC

covered in the 0.6.22 release we have pushed to SLE12 and SLE15 already.