CVE-2012-2812
libexif: "exif_entry_get_value()" heap-based out-of-bounds array read
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
La función exif_entry_get_value Exif-entry.c en la biblioteca de análisis de etiquetas EXIF (también conocido como libexif) antes de v0.6.21 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de límites) o, posiblemente, obtener información sensible de la memoria del proceso a través de etiquetas EXIF modificadas en una imagen.
Multiple vulnerabilities have been found in libexif and exif, some of which may allow execution of arbitrary code. Versions less than 0.6.21 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2012-05-19 CVE Reserved
- 2012-07-13 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/49988 | Third Party Advisory | |
| http://sourceforge.net/mailarchive/message.php?msg_id=29534027 | Mailing List | |
| http://www.securityfocus.com/bid/54437 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00014.html | 2023-11-07 | |
| http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html | 2023-11-07 | |
| http://rhn.redhat.com/errata/RHSA-2012-1255.html | 2023-11-07 | |
| http://www.debian.org/security/2012/dsa-2559 | 2023-11-07 | |
| http://www.ubuntu.com/usn/USN-1513-1 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2012-2812 | 2012-09-11 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=839203 | 2012-09-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Libexif Project Search vendor "Libexif Project" | Libexif Search vendor "Libexif Project" for product "Libexif" | <= 0.6.20 Search vendor "Libexif Project" for product "Libexif" and version " <= 0.6.20" | - |
Affected
| ||||||
| Libexif Project Search vendor "Libexif Project" | Libexif Search vendor "Libexif Project" for product "Libexif" | 0.6.14 Search vendor "Libexif Project" for product "Libexif" and version "0.6.14" | - |
Affected
| ||||||
| Libexif Project Search vendor "Libexif Project" | Libexif Search vendor "Libexif Project" for product "Libexif" | 0.6.15 Search vendor "Libexif Project" for product "Libexif" and version "0.6.15" | - |
Affected
| ||||||
| Libexif Project Search vendor "Libexif Project" | Libexif Search vendor "Libexif Project" for product "Libexif" | 0.6.16 Search vendor "Libexif Project" for product "Libexif" and version "0.6.16" | - |
Affected
| ||||||
| Libexif Project Search vendor "Libexif Project" | Libexif Search vendor "Libexif Project" for product "Libexif" | 0.6.18 Search vendor "Libexif Project" for product "Libexif" and version "0.6.18" | - |
Affected
| ||||||
| Libexif Project Search vendor "Libexif Project" | Libexif Search vendor "Libexif Project" for product "Libexif" | 0.6.19 Search vendor "Libexif Project" for product "Libexif" and version "0.6.19" | - |
Affected
| ||||||