[Pkg-phototools-devel] Bug#876466: libexif: CVE-2017-7544: Out-of-bounds heap read in exif_data_save_data_entry function
carnil at debian.org
Fri Sep 22 15:05:05 UTC 2017
Tags: security patch upstream
the following vulnerability was published for libexif.
| libexif through 0.6.21 is vulnerable to out-of-bounds heap read
| vulnerability in exif_data_save_data_entry function in
| libexif/exif-data.c caused by improper length computation of the
| allocated data of an ExifMnote entry which can cause denial-of-service
| or possibly information disclosure.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
The attched report in the upstream bug is password protected, but
there is a produced patch by Marcus Meissner in the upstream bug.
More information about the Pkg-phototools-devel