VulnerabilityModified
CVE-2020-13114
An issue was discovered in libexif before 0.6.22.
HIGH 7.5EPSS 2.30%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.30% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-770
- Affected
- libexif project/libexif · canonical/ubuntu linux · opensuse/leap
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.htmlMailing List, Third Party Advisory
- https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9babPatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/05/msg00025.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202007-05Third Party Advisory
- https://usn.ubuntu.com/4396-1/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.htmlMailing List, Third Party Advisory
- https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9babPatch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/05/msg00025.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202007-05Third Party Advisory
- https://usn.ubuntu.com/4396-1/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.