Vulnerability Details : CVE-2016-6328
A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).
Vulnerability category: OverflowDenial of serviceInformation leak
Exploit prediction scoring system (EPSS) score for CVE-2016-6328
Probability of exploitation activity in the next 30 days: 0.27%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 67 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2016-6328
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:P |
8.6
|
4.9
|
NIST |
|
6.1
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L |
1.8
|
4.2
|
Red Hat, Inc. |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
2.8
|
5.2
|
NIST |
CWE ids for CVE-2016-6328
-
The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Assigned by:
- nvd@nist.gov (Secondary)
- secalert@redhat.com (Primary)
References for CVE-2016-6328
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6328
1366239 – (CVE-2016-6328) CVE-2016-6328 libexif: Integer overflow in parsing MNOTE entry data of the input fileIssue Tracking;Patch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html
[SECURITY] [DLA 2214-1] libexif security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202007-05
libexif: Multiple vulnerabilities (GLSA 202007-05) — Gentoo securityThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
[security-announce] openSUSE-SU-2020:0793-1: moderate: Security update fMailing List;Third Party Advisory
-
https://usn.ubuntu.com/4277-1/
USN-4277-1: libexif vulnerabilities | Ubuntu security noticesThird Party Advisory
Products affected by CVE-2016-6328
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:a:libexif_project:libexif:*:*:*:*:*:*:*:*