[Pkg-phototools-devel] Bug#961410: libexif: CVE-2020-13114

[Salvatore Bonaccorso]

Source: libexif
Version: 0.6.21-8
Severity: important
Tags: security upstream
Control: found -1 0.6.21-7
Control: found -1 0.6.21-5.1+deb10u1
Control: found -1 0.6.21-5.1
Control: found -1 0.6.21-2+deb9u1
Control: found -1 0.6.21-2

Hi,

The following vulnerability was published for libexif.

CVE-2020-13114[0]:
| An issue was discovered in libexif before 0.6.22. An unrestricted size
| in handling Canon EXIF MakerNote data could lead to consumption of
| large amounts of compute time for decoding EXIF data.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-13114
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13114
[1] https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab

Regards,
Salvatore