CVE-2007-6351

libexif infinite recursion flaw (DoS)

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

libexif 0.6.16 and earlier allows context-dependent attackers to cause a denial of service (infinite recursion) via an image file with crafted EXIF tags, possibly involving the exif_loader_write function in exif_loader.c.

Libexif versión 0.6.16 y anteriores, permite a los atacantes dependiendo del contexto causar una denegación de servicio (recursividad infinita) por medio de un archivo de imagen con etiquetas EXIF especialmente diseñadas, que posiblemente involucra la función exif_loader_write en el archivo exif_loader.c.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-12-14 CVE Reserved
2007-12-20 CVE Published
2024-08-07 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (30)

URL	Tag	Source
http://bugs.gentoo.org/show_bug.cgi?id=202350	X_refsource_confirm
http://osvdb.org/42652	Vdb Entry
http://www.securityfocus.com/archive/1/485822/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/26976	Vdb Entry
http://www.securitytracker.com/id?1019124	Vdb Entry
https://bugzilla.redhat.com/show_bug.cgi?id=425621	X_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=425631	X_refsource_confirm
https://exchange.xforce.ibmcloud.com/vulnerabilities/39166	Vdb Entry
https://issues.rpath.com/browse/RPL-2068	X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9420	Signature

URL	Date	SRC

URL	Date	SRC
http://www.redhat.com/support/errata/RHSA-2007-1165.html	2021-01-26

URL	Date	SRC
http://secunia.com/advisories/28076	2021-01-26
http://secunia.com/advisories/28127	2021-01-26
http://secunia.com/advisories/28195	2021-01-26
http://secunia.com/advisories/28266	2021-01-26
http://secunia.com/advisories/28346	2021-01-26
http://secunia.com/advisories/28400	2021-01-26
http://secunia.com/advisories/28636	2021-01-26
http://secunia.com/advisories/28776	2021-01-26
http://secunia.com/advisories/32274	2021-01-26
http://security.gentoo.org/glsa/glsa-200712-15.xml	2021-01-26
http://www.debian.org/security/2008/dsa-1487	2021-01-26
http://www.mandriva.com/security/advisories?name=MDVSA-2008:005	2021-01-26
http://www.novell.com/linux/security/advisories/suse_security_summary_report.html	2021-01-26
http://www.ubuntu.com/usn/usn-654-1	2021-01-26
http://www.vupen.com/english/advisories/2007/4278	2021-01-26
https://bugzilla.redhat.com/show_bug.cgi?id=425551	2007-12-19
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00597.html	2021-01-26
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00626.html	2021-01-26
https://access.redhat.com/security/cve/CVE-2007-6351	2007-12-19

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Libexif Project Search vendor "Libexif Project"		Libexif Search vendor "Libexif Project" for product "Libexif"				<= 0.6.16 Search vendor "Libexif Project" for product "Libexif" and version " <= 0.6.16"		-		Affected
Libexif Project Search vendor "Libexif Project"		Libexif Search vendor "Libexif Project" for product "Libexif"				0.6.14 Search vendor "Libexif Project" for product "Libexif" and version "0.6.14"		-		Affected
Libexif Project Search vendor "Libexif Project"		Libexif Search vendor "Libexif Project" for product "Libexif"				0.6.15 Search vendor "Libexif Project" for product "Libexif" and version "0.6.15"		-		Affected