CVE-2020-0182 (Medium) detected in https://source.codeaurora.org/quic/la/platform/external/libexif/LA.UM.7.2.c6-10600-sdm660.0
Opened this issue · 0 comments
mend-bolt-for-github commented
CVE-2020-0182 - Medium Severity Vulnerability
Vulnerable Library - https://source.codeaurora.org/quic/la/platform/external/libexif/LA.UM.7.2.c6-10600-sdm660.0
Library home page: https://source.codeaurora.org/quic/la/platform/external/libexif/
Found in base branch: master
Vulnerability Details
In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917
Publish Date: 2020-06-11
URL: CVE-2020-0182
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://osv.dev/vulnerability/OSV-2020-1274
Release Date: 2020-07-06
Fix Resolution: libexif-0_6_22-release
Step up your Open Source Security Game with Mend here