Trinadh465/external_libexif_AOSP10_r33_CVE-2020-0181

CVE-2016-6328 (High) detected in https://source.codeaurora.org/quic/la/platform/external/libexif/android-r-preview-2

Opened this issue · 0 comments

mend-bolt-for-github commented

CVE-2016-6328 - High Severity Vulnerability

Vulnerable Library - https://source.codeaurora.org/quic/la/platform/external/libexif/android-r-preview-2

Library home page: https://source.codeaurora.org/quic/la/platform/external/libexif/

Found in base branch: master

Vulnerable Source Files (1)

/libexif/pentax/mnote-pentax-entry.c

Vulnerability Details

A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).

Publish Date: 2018-10-31

URL: CVE-2016-6328

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6328

Release Date: 2018-10-31

Fix Resolution: libexif-0_6_22-release

Step up your Open Source Security Game with Mend here