LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: October 27th, 2014
Linux Advisory Watch: October 24th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
RedHat: Moderate: libexif security update Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
RedHat Linux Updated libexif packages that fix a security issue are now available for Red Hat Enterprise Linux 4. The libexif packages contain the Exif library. Exif is an image file format specification that enables metadata tags to be added to existing JPEG, TIFF and RIFF files. The Exif library makes it possible to parse an Exif file and read this metadata. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: libexif security update
Advisory ID:       RHSA-2007:1166-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-1166.html
Issue date:        2007-12-19
Updated on:        2007-12-19
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-6352 
- ---------------------------------------------------------------------

1. Summary:

Updated libexif packages that fix a security issue are now available for
Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

The libexif packages contain the Exif library. Exif is an image file format
specification that enables metadata tags to be added to existing JPEG, TIFF
and RIFF files. The Exif library makes it possible to parse an Exif file
and read this metadata.

An integer overflow flaw was found in the way libexif parses Exif image
tags. If a victim opens a carefully crafted Exif image file, it could cause
the application linked against libexif to execute arbitrary code, or crash.
(CVE-2007-6352)

Users of libexif are advised to upgrade to these updated packages, which
contain a backported patch to resolve this issue.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

425561 - CVE-2007-6352 libexif integer overflow

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
260e767569adf64cc7bd5359e6ca9059  libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm

i386:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
cba10132a49290056136efe9160dc358  libexif-devel-0.5.12-5.1.0.2.el4_6.1.i386.rpm

ia64:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
00528e858aa4853cb43fe95572223fb5  libexif-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
9ae7aa25051814a3f35300cea755754a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
c1cb9d74c7756f3d5519d37d0e7e24fb  libexif-devel-0.5.12-5.1.0.2.el4_6.1.ia64.rpm

ppc:
d9c4c1761d584c5ceb693e4d4a25cff2  libexif-0.5.12-5.1.0.2.el4_6.1.ppc.rpm
1488abdeab9cd669eb528d213d2a0fd5  libexif-0.5.12-5.1.0.2.el4_6.1.ppc64.rpm
e2ca79a7acb61d309266dd89a609f22c  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ppc.rpm
7c46e330c4529c3af69b3073dac1b798  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ppc64.rpm
8a2582768cec7f1c138ea2be7233e7a1  libexif-devel-0.5.12-5.1.0.2.el4_6.1.ppc.rpm

s390:
7aef19a3a514ae5b33a401f9b8004d42  libexif-0.5.12-5.1.0.2.el4_6.1.s390.rpm
5e9024c5b814336172d9f160da29a560  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.s390.rpm
f0539bf3e24ccd7a870d5a62fd763193  libexif-devel-0.5.12-5.1.0.2.el4_6.1.s390.rpm

s390x:
7aef19a3a514ae5b33a401f9b8004d42  libexif-0.5.12-5.1.0.2.el4_6.1.s390.rpm
d66a5dd70c8aa83901eb19152458dc95  libexif-0.5.12-5.1.0.2.el4_6.1.s390x.rpm
5e9024c5b814336172d9f160da29a560  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.s390.rpm
b1b2906325d8762567c84d559472822b  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.s390x.rpm
55f2289b65e062160f68a3275e7a4ed1  libexif-devel-0.5.12-5.1.0.2.el4_6.1.s390x.rpm

x86_64:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
4c3588ded0ada47e1ff348b87b7cc46d  libexif-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
f40057ce7194e5940a8c9d062d83de30  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
f9cf7abb7972b3c39258750c63e1b6d6  libexif-devel-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
260e767569adf64cc7bd5359e6ca9059  libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm

i386:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
cba10132a49290056136efe9160dc358  libexif-devel-0.5.12-5.1.0.2.el4_6.1.i386.rpm

x86_64:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
4c3588ded0ada47e1ff348b87b7cc46d  libexif-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
f40057ce7194e5940a8c9d062d83de30  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
f9cf7abb7972b3c39258750c63e1b6d6  libexif-devel-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
260e767569adf64cc7bd5359e6ca9059  libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm

i386:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
cba10132a49290056136efe9160dc358  libexif-devel-0.5.12-5.1.0.2.el4_6.1.i386.rpm

ia64:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
00528e858aa4853cb43fe95572223fb5  libexif-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
9ae7aa25051814a3f35300cea755754a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
c1cb9d74c7756f3d5519d37d0e7e24fb  libexif-devel-0.5.12-5.1.0.2.el4_6.1.ia64.rpm

x86_64:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
4c3588ded0ada47e1ff348b87b7cc46d  libexif-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
f40057ce7194e5940a8c9d062d83de30  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
f9cf7abb7972b3c39258750c63e1b6d6  libexif-devel-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm
260e767569adf64cc7bd5359e6ca9059  libexif-0.5.12-5.1.0.2.el4_6.1.src.rpm

i386:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
cba10132a49290056136efe9160dc358  libexif-devel-0.5.12-5.1.0.2.el4_6.1.i386.rpm

ia64:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
00528e858aa4853cb43fe95572223fb5  libexif-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
9ae7aa25051814a3f35300cea755754a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.ia64.rpm
c1cb9d74c7756f3d5519d37d0e7e24fb  libexif-devel-0.5.12-5.1.0.2.el4_6.1.ia64.rpm

x86_64:
3b38729e0932d0993c2aa8447fd104d6  libexif-0.5.12-5.1.0.2.el4_6.1.i386.rpm
4c3588ded0ada47e1ff348b87b7cc46d  libexif-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
0e92cbf49a54e48aa6a290a9d85a0b0a  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.i386.rpm
f40057ce7194e5940a8c9d062d83de30  libexif-debuginfo-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm
f9cf7abb7972b3c39258750c63e1b6d6  libexif-devel-0.5.12-5.1.0.2.el4_6.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6352
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Pirate Bay founder guilty in historic hacker case
Parallels CTO: Linux container security is not the problem
Advisory says to assume all Drupal 7 websites are compromised
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.