CVE-2017-7544 Information disclosure in libexif

What is CVE-2017-7544?

CVE-2017-7544 is a critical vulnerability in Red Hat, Inc. libexif, published on 21 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure.

Weakness: CWE-125

Which versions are affected by CVE-2017-7544?

It affects 1 product.

Products include Libexif Project Libexif.

How do I fix CVE-2017-7544?

Apply the vendor's patch.

Is CVE-2017-7544 being exploited?

There is no known exploitation of CVE-2017-7544 in the wild and no public exploit code.

Other vulnerabilities in Red Hat, Inc. libexif

• CVE-2018-20030 Denial of service in libexif High 7.5
• CVE-2012-2814 Memory corruption in n/a High 7.5
• CVE-2012-2840 Integer overflow in n/a High 7.5
• CVE-2012-2841 Integer overflow in n/a High 7.5
• CVE-2026-32775 Integer overflow in libexif High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2017-7544, DEBIAN-CVE-2017-7544, GHSA-552w-mcq2-q5xm, MGASA-2018-0113, SUSE-SU-2018:0195-1, UBUNTU-CVE-2017-7544.