crítica
CVE-2020-0452
libexif: out of bounds write due to an integer overflow in exif-entry.c
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-159625731
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | libexif, libexif-devel | 0.6.22-5.el8_3 |
| alpine 3.14 | libexif | 0.6.23-r0 |
| alpine 3.15 | libexif | 0.6.23-r0 |
| alpine 3.16 | libexif | 0.6.23-r0 |
| alpine 3.17 | libexif | 0.6.23-r0 |
| alpine 3.18 | libexif | 0.6.23-r0 |
| alpine 3.19 | libexif | 0.6.23-r0 |
| alpine 3.20 | libexif | 0.6.23-r0 |
| alpine 3.21 | libexif | 0.6.23-r0 |
| alpine 3.22 | libexif | 0.6.23-r0 |
| alpine 3.23 | libexif | 0.6.23-r0 |
| alpine 3.24 | libexif | 0.6.23-r0 |
Mostrar las 44 entradas de 36 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | libexif | 0.6.22-5.el8_3 |
| alma 8 | libexif-devel | 0.6.22-5.el8_3 |
| alpine 3.14 | libexif | 0.6.23-r0 |
| alpine 3.15 | libexif | 0.6.23-r0 |
| alpine 3.16 | libexif | 0.6.23-r0 |
| alpine 3.17 | libexif | 0.6.23-r0 |
| alpine 3.18 | libexif | 0.6.23-r0 |
| alpine 3.19 | libexif | 0.6.23-r0 |
| alpine 3.20 | libexif | 0.6.23-r0 |
| alpine 3.21 | libexif | 0.6.23-r0 |
| alpine 3.22 | libexif | 0.6.23-r0 |
| alpine 3.23 | libexif | 0.6.23-r0 |
| alpine 3.24 | libexif | 0.6.23-r0 |
| alpine edge | libexif | 0.6.23-r0 |
| amazon linux 2 | libexif | 0.6.22-2.amzn2 |
| amazon linux 2 | libexif-debuginfo | 0.6.22-2.amzn2 |
| amazon linux 2 | libexif-devel | 0.6.22-2.amzn2 |
| amazon linux 2 | libexif-doc | 0.6.22-2.amzn2 |
| debian 10 | libexif | 0.6.21-5.1+deb10u5 |
| debian 11 | libexif | 0.6.22-3 |
| debian 12 | libexif | 0.6.22-3 |
| debian 13 | libexif | 0.6.22-3 |
| debian 14 | libexif | 0.6.22-3 |
| debian 9 | libexif | 0.6.21-2+deb9u5 |
| echo | libexif | 0.6.22-3 |
| Oracle Linux 7 | libexif | 0.6.22-2.el7_9 |
| Oracle Linux 7 | libexif-devel | 0.6.22-2.el7_9 |
| Oracle Linux 7 | libexif-doc | 0.6.22-2.el7_9 |
| Oracle Linux 8 | libexif | 0.6.22-5.el8_3 |
| Oracle Linux 8 | libexif-devel | 0.6.22-5.el8_3 |
| Red Hat | libexif | sin corrección indicada |
| Red Hat | libexif-devel | sin corrección indicada |
| rocky 8 | libexif | 0.6.22-5.el8_3 |
| root.io debian 11 | rootio-libexif | 0.6.22-3 |
| root.io debian 12 | rootio-libexif | 0.6.22-3 |
| root.io debian 13 | rootio-libexif | 0.6.22-3 |
| ubuntu 14.04-ESM | libexif | 0.6.21-1ubuntu1+esm6 |
| ubuntu 16.04 | libexif | 0.6.21-2ubuntu0.6 |
| ubuntu 16.04-ESM | libexif | 0.6.21-2ubuntu0.6 |
| ubuntu 18.04 | libexif | 0.6.21-4ubuntu0.6 |
| ubuntu 18.04-ESM | libexif | 0.6.21-4ubuntu0.6 |
| ubuntu 20.04 | libexif | 0.6.21-6ubuntu0.4 |
| ubuntu 20.04-ESM | libexif | 0.6.21-6ubuntu0.4 |
| ubuntu 20.10 | libexif | 0.6.22-2ubuntu0.1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2020-0452
- https://bugzilla.redhat.com/show_bug.cgi?id=1902004
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0452
- https://errata.almalinux.org/8/ALSA-2020-5393.html
- https://errata.rockylinux.org/RLSA-2020:5393
- https://linux.oracle.com/cve/CVE-2020-0452.html
- https://linux.oracle.com/errata/ELSA-2020-5402.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ELDZR6USD5PR34MRK2ZISLCYJ465FNKN/
Las 14 referencias
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVBD5JRUQPN4LQHTAAJHA3MR5M7YTAC7/
- https://nvd.nist.gov/vuln/detail/CVE-2020-0452
- https://security.gentoo.org/glsa/202011-19
- https://source.android.com/security/bulletin/2020-11-01
- https://ubuntu.com/security/notices/USN-4624-1
- https://www.cve.org/CVERecord?id=CVE-2020-0452