CVE-2007-6353: Buffer Overflow
Integer overflow in exif.cpp in exiv2 library allows context-dependent attackers to execute arbitrary code via a crafted EXIF file that triggers a heap-based buffer overflow.
Other sources
Meder Kydyraliev reported an integer overflow exiv2's EXIF parsing code resulting in heap buffer oveflow. This can possibly lead to code execution as user running application using exiv2 library to extract EXIF tags from malicious image files.
Upstream commit: http://dev.robotbattle.com/~cvsuser/cgi-bin/nsviewcvs.cgi/exiv2/trunk/src/exif.cpp?rev=1346&r1=1231&r2=1346
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-6353?
CVE-2007-6353 has a moderate severity rating due to its potential to allow arbitrary code execution.
How do I fix CVE-2007-6353?
To fix CVE-2007-6353, update the Exiv2 library to version 0.16 or higher.
What systems are affected by CVE-2007-6353?
CVE-2007-6353 affects various systems including Exiv2 versions lower than 0.16 and specific Debian and Ubuntu versions.
What is the main cause of CVE-2007-6353?
CVE-2007-6353 is caused by an integer overflow in the EXIF parsing code of the Exiv2 library.
Can CVE-2007-6353 lead to a denial of service?
Yes, CVE-2007-6353 can be exploited to create a denial of service due to a heap-based buffer overflow.