Ubuntu 20.10: USN-4624-1 Critical: libexif Arbitrary Code Execution

ubuntu

November 10, 2020

libexif could be made to execute arbitrary code if it received a specially crafted input.

Summary

libexif could be made to execute arbitrary code if it received a specially

crafted input.

Software Description:

- libexif: library to parse EXIF files

Details:

It was discovered that libexif incorrectly handled certain inputs.

An attacker could possibly use this issue to cause unexpected behaviours,

or execute arbitrary code.

Topics Covered

security advisory update instructions arbitrary code ubuntu input handling libexif execution issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  libexif12                       0.6.22-2ubuntu0.1

Ubuntu 20.04 LTS:
  libexif12                       0.6.21-6ubuntu0.4

Ubuntu 18.04 LTS:
  libexif12                       0.6.21-4ubuntu0.6

Ubuntu 16.04 LTS:
  libexif12                       0.6.21-2ubuntu0.6

Ubuntu 14.04 ESM:
  libexif12                       0.6.21-1ubuntu1+esm6

Ubuntu 12.04 ESM:
  libexif12                       0.6.20-2ubuntu0.7

In general, a standard system update will make all the necessary changes.