CVE-2016-6328: Integer Overflow
A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).
Other sources
In mnotepentaxentrygetvalue of mnote-pentax-entry.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libexifto a version that resolves this vulnerability.Fixed in 0.6.22-3Fixed in 0.6.24-1Fixed in 0.6.25-1 - Upgrade
Upgrade
alpine/libexifto a version that resolves this vulnerability.Fixed in 0.6.22-r0 - Upgrade
Upgrade
android/platform/external/libexifto a version that resolves this vulnerability.Fixed in 8.0:2021-01-01 - Upgrade
Upgrade
android/platform/external/libexifto a version that resolves this vulnerability.Fixed in 8.1:2021-01-01 - Upgrade
Upgrade
android/platform/external/libexifto a version that resolves this vulnerability.Fixed in 9:2021-01-01 - Upgrade
Upgrade
android/platform/external/libexifto a version that resolves this vulnerability.Fixed in 10:2021-01-01 - Upgrade
Upgrade
android/platform/external/libexifto a version that resolves this vulnerability.Fixed in 11:2021-01-01
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2016-6328.
What is the severity of CVE-2016-6328?
The severity of CVE-2016-6328 is high with a CVSS score of 8.1.
What is the affected software?
The affected software includes libexif versions up to and including 0.6.21-1ubuntu1+.
What are the potential impacts of CVE-2016-6328?
The potential impacts of CVE-2016-6328 include Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).
Where can I find more information about CVE-2016-6328?
You can find more information about CVE-2016-6328 at the following references: [1] [2] [3].