CVE-2020-13113 : An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in

An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.

Published 2020-05-21 17:15:10

Updated 2022-04-26 20:50:56

Source MITRE

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2020-13113

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 19.10
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 20.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Libexif Project » Libexif
Versions before (<) 0.6.22
cpe:2.3:a:libexif_project:libexif:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-13113

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 57 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-13113

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Partial
8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	3.9	4.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: High

CWE ids for CVE-2020-13113

CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-13113

https://github.com/libexif/libexif/commit/ec412aa4583ad71ecabb967d3c77162760169d1f

Ensure the MakerNote data pointers are initialized with NULL. · libexif/libexif@ec412aa · GitHub
Patch;Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html

[SECURITY] [DLA 2222-1] libexif security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202007-05

libexif: Multiple vulnerabilities (GLSA 202007-05) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html

[security-announce] openSUSE-SU-2020:0793-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/4396-1/

USN-4396-1: libexif vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-13113

Products affected by CVE-2020-13113

Exploit prediction scoring system (EPSS) score for CVE-2020-13113

CVSS scores for CVE-2020-13113

CWE ids for CVE-2020-13113

References for CVE-2020-13113