National Cyber Awareness System

Vulnerability Summary for CVE-2007-6352

Overview

Integer overflow in libexif 0.6.16 and earlier allows context-dependent attackers to execute arbitrary code via an image with crafted EXIF tags, possibly involving the exif_data_load_data_thumbnail function in exif-data.c.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2007-4667

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00626.html

External Source: FEDORA

Name: FEDORA-2007-4608

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00597.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-2068

Hyperlink:https://issues.rpath.com/browse/RPL-2068

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=425631

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=425631

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=425621

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=425621

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=425561

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=425561

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=425561

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=425561

External Source: XF

Name: libexif-exifdataloaddatathumbnail-bo(39167)

Hyperlink:http://xforce.iss.net/xforce/xfdb/39167

External Source: VUPEN

Name: ADV-2008-0947

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2008/0947/references

External Source: VUPEN

Name: ADV-2007-4278

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2007/4278

External Source: UBUNTU

Name: USN-654-1

Hyperlink:http://www.ubuntu.com/usn/usn-654-1

External Source: SECTRACK

Name: 1019124

Hyperlink:http://www.securitytracker.com/id?1019124

External Source: BID

Name: 26942

Hyperlink:http://www.securityfocus.com/bid/26942

External Source: BUGTRAQ

Name: 20080105 rPSA-2008-0006-1 libexif

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/485822/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:1166

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-1166.html

External Source: REDHAT

Name: RHSA-2007:1165

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-1165.html

External Source: SUSE

Name: SUSE-SR:2008:002

Hyperlink:http://www.novell.com/linux/security/advisories/suse_security_summary_report.html

External Source: MANDRIVA

Name: MDVSA-2008:005

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:005

External Source: DEBIAN

Name: DSA-1487

Hyperlink:http://www.debian.org/security/2008/dsa-1487

External Source: SUNALERT

Name: 234701

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-234701-1

External Source: GENTOO

Name: GLSA-200712-15

Hyperlink:http://security.gentoo.org/glsa/glsa-200712-15.xml

External Source: SECUNIA

Name: 32274

Type: Advisory

Hyperlink:http://secunia.com/advisories/32274

External Source: SECUNIA

Name: 29381

Type: Advisory

Hyperlink:http://secunia.com/advisories/29381

External Source: SECUNIA

Name: 28776

Type: Advisory

Hyperlink:http://secunia.com/advisories/28776

External Source: SECUNIA

Name: 28636

Type: Advisory

Hyperlink:http://secunia.com/advisories/28636

External Source: SECUNIA

Name: 28400

Type: Advisory

Hyperlink:http://secunia.com/advisories/28400

External Source: SECUNIA

Name: 28346

Type: Advisory

Hyperlink:http://secunia.com/advisories/28346

External Source: SECUNIA

Name: 28266

Type: Advisory

Hyperlink:http://secunia.com/advisories/28266

External Source: SECUNIA

Name: 28195

Type: Advisory

Hyperlink:http://secunia.com/advisories/28195

External Source: SECUNIA

Name: 28127

Type: Advisory

Hyperlink:http://secunia.com/advisories/28127

External Source: SECUNIA

Name: 28076

Type: Advisory

Hyperlink:http://secunia.com/advisories/28076

External Source: OVAL

Name: oval:org.mitre.oval:def:11029

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11029

External Source: OSVDB

Name: 42653

Hyperlink:http://osvdb.org/42653

External Source: CONFIRM

Name: http://bugs.gentoo.org/show_bug.cgi?id=202350

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=202350

US Government Resource: oval:org.mitre.oval:def:4814

Name: oval:org.mitre.oval:def:4814

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:4814

References to Check Content

Identifier:oval:org.mitre.oval:def:4814

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:4814

Identifier:oval:org.mitre.oval:def:11029

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11029