USN-654-1: libexif vulnerabilities

Releases

• Ubuntu 7.10
• Ubuntu 7.04
• Ubuntu 6.06

Packages

• libexif -

Details

Meder Kydyraliev discovered that libexif did not correctly handle certain
EXIF headers. If a user or automated system were tricked into processing
a specially crafted image, a remote attacker could cause the application
linked against libexif to crash, leading to a denial of service, or
possibly executing arbitrary code with user privileges.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 7.10

• libexif12 - 0.6.16-1ubuntu0.1

Ubuntu 7.04

• libexif12 - 0.6.13-5ubuntu0.3

Ubuntu 6.06

• libexif12 - 0.6.12-2ubuntu0.3

After a standard system upgrade you need to restart your session to effect
the necessary changes.

References

• CVE-2007-6351
• CVE-2007-6352