CVE-2020-13114

Опубликовано: 21 мая 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
Mailing List
Third Party Advisory
https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202007-05
Third Party Advisory
https://usn.ubuntu.com/4396-1/
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
Mailing List
Third Party Advisory
https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202007-05
Third Party Advisory
https://usn.ubuntu.com/4396-1/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:libexif_project:libexif:*:*:*:*:*:*:*:*

Версия до 0.6.22 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Конфигурация 3

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

EPSS

Процентиль: 73%

0.00774

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-770

Связанные уязвимости

CVE-2020-13114

CVSS3: 7.5

ubuntu

больше 5 лет назад

An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.

CVE-2020-13114

CVSS3: 7.5

redhat

больше 5 лет назад

An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.

CVE-2020-13114

CVSS3: 7.5

debian

больше 5 лет назад

An issue was discovered in libexif before 0.6.22. An unrestricted size ...

GHSA-mpfc-53hr-w2mg

CVSS3: 7.5

github

больше 3 лет назад

An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.

BDU:2021-03725

CVSS3: 7.5

fstec

больше 5 лет назад

Уязвимость библиотеки для грамматического разбора EXIF-файлов libexif, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 73%

0.00774

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-770