CVE-2020-13113: Use After Free
Published May 21, 2020
·Updated
An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.
Affected Software
30 affected componentsFixes available
Libexif Project Libexif<0.6.22
Debian Debian Linux=8.0
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.10
Canonical Ubuntu Linux=20.04
openSUSE Leap=15.1
debian/libexif
0.6.22-30.6.24-10.6.25-10.6.25-2
Google Android
android/platform/external/libexif>=10:0<10:2022-02-01
10:2022-02-01
android/platform/external/libexif>=11:0<11:2022-02-01
11:2022-02-01
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
alpine/libexif<0.6.22-r0
0.6.22-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libexifto a version that resolves this vulnerability.Fixed in 0.6.22-3Fixed in 0.6.24-1Fixed in 0.6.25-1Fixed in 0.6.25-2 - Upgrade
Upgrade
alpine/libexifto a version that resolves this vulnerability.Fixed in 0.6.22-r0 - Upgrade
Upgrade
android/platform/external/libexifto a version that resolves this vulnerability.Fixed in 10:2022-02-01 - Upgrade
Upgrade
android/platform/external/libexifto a version that resolves this vulnerability.Fixed in 11:2022-02-01 - Upgrade
Upgrade
libexifto a version that resolves this vulnerability.Fixed in 0.6.22
Event History
May 21, 2020
CVE Published
via MITRE·04:03 PM
Data Sourced
via MITRE·04:03 PM
Description
Data Sourced
via NVD·05:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·05:15 PM
DescriptionSeverityAffected Software
Feb 1, 2022
Advisory Published
via OSV·12:00 AM
Feb 7, 2022
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software