The remote host is affected by the vulnerability described in GLSA-202011-19 (libexif: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libexif. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libexif packages installed that are affected by multiple vulnerabilities:

  - In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote     escalation of privilege in the media content provider with no additional execution privileges needed. User     interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774     (CVE-2019-9278)

  - exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error. (CVE-2020-12767)

  - An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling     could lead to crashes and potential use-after-free conditions. (CVE-2020-13113)

  - An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote     data could lead to consumption of large amounts of compute time for decoding EXIF data. (CVE-2020-13114)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure with no additional execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID:
    A-147140917 (CVE-2020-0182)

  - In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing     bounds check. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1     Android-9 Android-10Android ID: A-148705132 (CVE-2020-0093)

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a third party app used this library to process     remote image data with no additional execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731 (CVE-2020-0452)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0003 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-0198:
    In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow.
    This could lead to remote denial of service with no additional execution privileges needed. User     interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941

    CVE-2020-0452:
    In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a third party app used this library to process     remote image data with no additional execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

In libexif/exif-entry.c, through libexif 0.6.21-2+deb9u4, compiler optimization could remove a buffer overflow check, making a buffer overflow possible with some EXIF tags.

For Debian 9 stretch, this problem has been fixed in version 0.6.21-2+deb9u5.

We recommend that you upgrade your libexif packages.

For the detailed security status of libexif please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libexif

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5395 advisory.

    The libexif packages provide a library for extracting extra information from image files.

    Security Fix(es):

    * libexif: out of bounds write due to an integer overflow in exif-entry.c (CVE-2020-0452)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In exif_entry_get_value of exif-entry.c, there is a     possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a     third party app used this library to process remote     image data with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1     Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731(CVE-2020-0452)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5393 advisory.

    The libexif packages provide a library for extracting extra information from image files.

    Security Fix(es):

    * libexif: out of bounds write due to an integer overflow in exif-entry.c (CVE-2020-0452)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In exif_entry_get_value of exif-entry.c, there is a     possible out of bounds read due to a missing bounds     check. This could lead to local information disclosure     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10Android ID:
    A-147140917(CVE-2020-0182)

  - In exif_entry_get_value of exif-entry.c, there is a     possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a     third party app used this library to process remote     image data with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1     Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731(CVE-2020-0452)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1148-1 advisory.

    - CVE-2020-0181: Fixed an integer overflow that could lead to denial of service       (bsc#1172802).
    - CVE-2020-0198: Fixed and unsigned integer overflow that could lead to denial       of service (bsc#1172768).
    - CVE-2020-0452: Fixed a buffer overflow check that could be optimized away       by the compiler (bsc#1178479).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
142939	GLSA-202011-19 : libexif: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/11/17	2024/2/8	critical
147354	NewStart CGSL CORE 5.04 / MAIN 5.04 : libexif Multiple Vulnerabilities (NS-SA-2021-0036)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/11	critical
236553	Alibaba Cloud Linux 3 : 0003: libexif (ALINUX3-SA-2021:0003)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
142623	Debian DLA-2439-1 : libexif security update	Nessus	Debian Local Security Checks	2020/11/9	2020/11/20	critical
144114	RHEL 8 : libexif (RHSA-2020:5395)	Nessus	Red Hat Local Security Checks	2020/12/14	2024/11/7	critical
144164	EulerOS 2.0 SP8 : libexif (EulerOS-SA-2020-2515)	Nessus	Huawei Local Security Checks	2020/12/14	2024/2/2	critical
144553	RHEL 8 : libexif (RHSA-2020:5393)	Nessus	Red Hat Local Security Checks	2020/12/22	2024/11/7	critical
149200	EulerOS 2.0 SP3 : libexif (EulerOS-SA-2021-1809)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/2	critical
159652	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libexif (SUSE-SU-2022:1148-1)	Nessus	SuSE Local Security Checks	2022/4/12	2026/6/26	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical