CVE-2012-2840: High severity Libexif Project Libexif vulnerability
Off-by-one error in the exifconvertutf16toutf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/libexifto a version that resolves this vulnerability.Fixed in 0.6.21-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2840?
CVE-2012-2840 has a medium severity level, potentially leading to denial of service or arbitrary code execution.
How do I fix CVE-2012-2840?
To fix CVE-2012-2840, upgrade libexif to version 0.6.21 or later.
What software is affected by CVE-2012-2840?
CVE-2012-2840 affects libexif versions prior to 0.6.21, including versions 0.6.14 to 0.6.20.
Can CVE-2012-2840 be exploited remotely?
Yes, CVE-2012-2840 can be exploited remotely through crafted EXIF tags in an image.
What impact does CVE-2012-2840 have on applications?
CVE-2012-2840 can cause denial of service and may allow an attacker to execute arbitrary code in affected applications.