CVE-2019-9278

Опубликовано: 27 сент. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/25/17
Mailing List
http://www.openwall.com/lists/oss-security/2019/10/27/1
Mailing List
http://www.openwall.com/lists/oss-security/2019/11/07/1
Mailing List
https://github.com/libexif/libexif/commit/75aa73267fdb1e0ebfbc00369e7312bac43d0566
Patch
Third Party Advisory
https://github.com/libexif/libexif/issues/26
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00007.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO2VTHD7OLPJDCJBHKUQTBAHZOBBCF6X/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VA5BPQLOFXIZOOJHBYDU635Z5KLUMTDD/
https://seclists.org/bugtraq/2020/Feb/9
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202007-05
Third Party Advisory
https://source.android.com/security/bulletin/android-10
Vendor Advisory
https://usn.ubuntu.com/4277-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4618
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00000.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/10/25/17
Mailing List
http://www.openwall.com/lists/oss-security/2019/10/27/1
Mailing List
http://www.openwall.com/lists/oss-security/2019/11/07/1
Mailing List

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.04059

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-190

Связанные уязвимости

CVE-2019-9278

CVSS3: 8.8

ubuntu

почти 7 лет назад

CVE-2019-9278

CVSS3: 7.5

redhat

больше 6 лет назад

CVE-2019-9278

CVSS3: 8.8

debian

почти 7 лет назад

In libexif, there is a possible out of bounds write due to an integer ...

GHSA-wwvf-m6j5-65jw

CVSS3: 8.8

github

около 4 лет назад

BDU:2020-01749

CVSS3: 8.8

fstec

почти 7 лет назад

Уязвимость библиотеки для грамматического разбора EXIF-файлов libexif, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

EPSS

Процентиль: 90%

0.04059

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-190