Libexif exif_entry_get_value Function Arbitrary Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
Libexif 0.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54437
Cve id: CVE-2012-2841

Libexif is a function library written in C. It is used to read and write EXIF metadata from graph files.

The EXIF Tag Parsing Library (libexif) 0.6.21 and earlier versions of the exif_entry_get_value function in the exif-entry.c has an integer overflow security vulnerability in processing specially crafted EXIF tags in the graphic, allowing remote attackers to execute arbitrary code.

<* Source: Mateusz Jurczyk
Yunho Kim
Dan Fandrich

Link: http://sourceforge.net/mailarchive/message.php? Ms. g_id = 29534027
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Libexif
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://libexif.sourceforge.net/