Vulnerability Details : CVE-2020-0093
In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148705132
Published
2020-05-14 21:15:12
Updated
2022-10-14 02:40:58
Vulnerability category: Information leak
Threat overview for CVE-2020-0093
Top countries where our scanners detected CVE-2020-0093
Top open port discovered on systems with this issue
80
IPs affected by CVE-2020-0093 697
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2020-0093!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2020-0093
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2020-0093
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
1.9
|
LOW | AV:L/AC:M/Au:N/C:P/I:N/A:N |
3.4
|
2.9
|
NIST |
5.0
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N |
1.3
|
3.6
|
NIST |
CWE ids for CVE-2020-0093
-
The product reads data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-0093
-
https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html
[SECURITY] [DLA 2214-1] libexif security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202007-05
libexif: Multiple vulnerabilities (GLSA 202007-05) — Gentoo securityPatch;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
[security-announce] openSUSE-SU-2020:0793-1: moderate: Security update fMailing List;Third Party Advisory
-
https://usn.ubuntu.com/4396-1/
USN-4396-1: libexif vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://source.android.com/security/bulletin/2020-05-01
Android Security Bulletin—May 2020 | Android Open Source ProjectPatch;Vendor Advisory
Products affected by CVE-2020-0093
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:a:libexif_project:libexif:*:*:*:*:*:*:*:*