Home / mailings [RHSA-2007:1166-01] Moderate: libexif security update
Posted on 19 December 2007
RedHat-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Moderate: libexif security update
Advisory ID: RHSA-2007:1166-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1166.html
Issue date: 2007-12-19
Updated on: 2007-12-19
Product: Red Hat Enterprise Linux
CVE Names: CVE-2007-6352
- ---------------------------------------------------------------------
1. Summary:
Updated libexif packages that fix a security issue are now available for
Red Hat Enterprise Linux 4.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Problem description:
The libexif packages contain the Exif library. Exif is an image file format
specification that enables metadata tags to be added to existing JPEG, TIFF
and RIFF files. The Exif library makes it possible to parse an Exif file
and read this metadata.
An integer overflow flaw was found in the way libexif parses Exif image
tags. If a victim opens a carefully crafted Exif image file, it could cause
the application linked against libexif to execute arbitrary code, or crash.
(CVE-2007-6352)
Users of libexif are advised to upgrade to these updated packages, which
contain a backported patch to resolve this issue.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
425561 - CVE-2007-6352 libexif integer overflow
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
260e767569adf64cc7bd5359e6ca9059 libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
i386:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
cba10132a49290056136efe9160dc358 libexif-devel-0.5.12-5.1.0.2.el4_6.1.i386.rpm
ia64:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
00528e858aa4853cb43fe95572223fb5 libexif-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
9ae7aa25051814a3f35300cea755754a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
c1cb9d74c7756f3d5519d37d0e7e24fb libexif-devel-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
ppc:
d9c4c1761d584c5ceb693e4d4a25cff2 libexif-0.5.12-5.1.0.2.el4_6.1.ppc.rpm
1488abdeab9cd669eb528d213d2a0fd5 libexif-0.5.12-5.1.0.2.el4_6.1.ppc64.rpm
e2ca79a7acb61d309266dd89a609f22c libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ppc.rpm
7c46e330c4529c3af69b3073dac1b798 libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ppc64.rpm
8a2582768cec7f1c138ea2be7233e7a1 libexif-devel-0.5.12-5.1.0.2.el4_6.1.ppc.rpm
s390:
7aef19a3a514ae5b33a401f9b8004d42 libexif-0.5.12-5.1.0.2.el4_6.1.s390.rpm
5e9024c5b814336172d9f160da29a560 libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.s390.rpm
f0539bf3e24ccd7a870d5a62fd763193 libexif-devel-0.5.12-5.1.0.2.el4_6.1.s390.rpm
s390x:
7aef19a3a514ae5b33a401f9b8004d42 libexif-0.5.12-5.1.0.2.el4_6.1.s390.rpm
d66a5dd70c8aa83901eb19152458dc95 libexif-0.5.12-5.1.0.2.el4_6.1.s390x.rpm
5e9024c5b814336172d9f160da29a560 libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.s390.rpm
b1b2906325d8762567c84d559472822b libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.s390x.rpm
55f2289b65e062160f68a3275e7a4ed1 libexif-devel-0.5.12-5.1.0.2.el4_6.1.s390x.rpm
x86_64:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
4c3588ded0ada47e1ff348b87b7cc46d libexif-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
f40057ce7194e5940a8c9d062d83de30 libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
f9cf7abb7972b3c39258750c63e1b6d6 libexif-devel-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
260e767569adf64cc7bd5359e6ca9059 libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
i386:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
cba10132a49290056136efe9160dc358 libexif-devel-0.5.12-5.1.0.2.el4_6.1.i386.rpm
x86_64:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
4c3588ded0ada47e1ff348b87b7cc46d libexif-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
f40057ce7194e5940a8c9d062d83de30 libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
f9cf7abb7972b3c39258750c63e1b6d6 libexif-devel-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
260e767569adf64cc7bd5359e6ca9059 libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
i386:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
cba10132a49290056136efe9160dc358 libexif-devel-0.5.12-5.1.0.2.el4_6.1.i386.rpm
ia64:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
00528e858aa4853cb43fe95572223fb5 libexif-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
9ae7aa25051814a3f35300cea755754a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
c1cb9d74c7756f3d5519d37d0e7e24fb libexif-devel-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
x86_64:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
4c3588ded0ada47e1ff348b87b7cc46d libexif-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
f40057ce7194e5940a8c9d062d83de30 libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
f9cf7abb7972b3c39258750c63e1b6d6 libexif-devel-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
260e767569adf64cc7bd5359e6ca9059 libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
i386:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
cba10132a49290056136efe9160dc358 libexif-devel-0.5.12-5.1.0.2.el4_6.1.i386.rpm
ia64:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
00528e858aa4853cb43fe95572223fb5 libexif-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
9ae7aa25051814a3f35300cea755754a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
c1cb9d74c7756f3d5519d37d0e7e24fb libexif-devel-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
x86_64:
3b38729e0932d0993c2aa8447fd104d6 libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
4c3588ded0ada47e1ff348b87b7cc46d libexif-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
f40057ce7194e5940a8c9d062d83de30 libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
f9cf7abb7972b3c39258750c63e1b6d6 libexif-devel-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6352
http://www.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
