libexif EXIF Tag Structure Validation Vulnerability

“Secunia Advisory: SA14504

Critical: Highly critical

Impact: DoS, System access

Where: From remote

Solution Status: Unpatched

Software: libexif 0.x

Sylvain Defresne has reported a vulnerability in libexif, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise vulnerable systems.

The vulnerability is caused due to an error within the validation of EXIF tag structures and can be exploited via a malicious image file containing a specially crafted EXIF tag.

Successful exploitation crashes an application linked against the vulnerable library and may also allow execution of arbitrary code with the privileges of the application.

The vulnerability has been reported in version 0.6.9. Other versions may also be affected.

Solution: Secunia is currently not aware of an official version or patch addressing this vulnerability.

Don’t process untrusted images in applications using libexif.

Full article: Secunia Advisory: SA14504