libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c c

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• libexif project libexifup to 0.6.21 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat, Inc. libexif

  • through 0.6.21affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2020-13112An issue was discovered in libexif before 0.6.22.
  37Monitor
• CVE-2020-13113An issue was discovered in libexif before 0.6.22.
  33Monitor
• CVE-2016-6328A vulnerability was found in libexif.
  33Monitor
• CVE-2012-2841Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 might allow remo
  32Monitor
• CVE-2012-2840Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allo
  32Monitor
• CVE-2012-2814Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote a
  32Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.