Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 293192 - =media-libs/libexif-0.6.18: Heap buffer overflow
Summary: =media-libs/libexif-0.6.18: Heap buffer overflow
Status: RESOLVED DUPLICATE of bug 293190
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Security
Depends on:
Reported: 2009-11-14 17:38 UTC by Arfrever Frehtes Taifersar Arahesis (RETIRED)
Modified: 2009-11-14 17:43 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Arfrever Frehtes Taifersar Arahesis (RETIRED) gentoo-dev 2009-11-14 17:38:16 UTC
A flaw in libexif was discovered that causes a heap buffer to overflow when certain invalid EXIF images are processed. The flaw occurs in the tag fixup routine which attempts to convert in place an array of 8-bit integers into 16-bit integers. This fixup is performed by default after reading an image and until version 0.6.18 there was no easy way to disable it, so it is likely that nearly all applications using libexif to read images are vulnerable.

Only libexif version 0.6.18 is affected by this flaw. Version 0.6.17 and previous and 0.6.19 and later are not affected.
Comment 1 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-11-14 17:43:51 UTC

*** This bug has been marked as a duplicate of bug 293190 ***