Test Kennung:	1.3.6.1.4.1.25623.1.0.892214
Kategorie:	Debian Local Security Checks
Titel:	Debian LTS: Security Advisory for libexif (DLA-2214-1)
Zusammenfassung:	The remote host is missing an update for the 'libexif'; package(s) announced via the DLA-2214-1 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'libexif' package(s) announced via the DLA-2214-1 advisory. Vulnerability Insight: Various vulnerabilities have been addressed in libexif, a library to parse EXIF metadata files. CVE-2016-6328 An integer overflow when parsing the MNOTE entry data of the input file had been found. This could have caused Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data). CVE-2017-7544 libexif had been vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which could have caused denial-of-service or possibly information disclosure. CVE-2018-20030 An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version could have been exploited to exhaust available CPU resources. CVE-2020-0093 In exif_data_save_data_entry of exif-data.c, there was a possible out of bounds read due to a missing bounds check. This could have lead to local information disclosure with no additional execution privileges needed. User interaction was needed for exploitation. CVE-2020-12767 libexif had a divide-by-zero error in exif_entry_get_value in exif-entry.c Affected Software/OS: 'libexif' package(s) on Debian Linux. Solution: For Debian 8 'Jessie', these problems have been fixed in version 0.6.21-2+deb8u2. We recommend that you upgrade your libexif packages. CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6328 https://security.gentoo.org/glsa/202007-05 https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html SuSE Security Announcement: openSUSE-SU-2020:0793 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html https://usn.ubuntu.com/4277-1/ Common Vulnerability Exposure (CVE) ID: CVE-2017-7544 https://sourceforge.net/p/libexif/bugs/130/ Common Vulnerability Exposure (CVE) ID: CVE-2020-0093 https://source.android.com/security/bulletin/2020-05-01 https://usn.ubuntu.com/4396-1/
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.