Issued:
2007-12-19
Updated:
2007-12-19

RHSA-2007:1165 - Security Advisory

Synopsis

Moderate: libexif security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated libexif packages that fix several security issues are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The libexif packages contain the Exif library. Exif is an image file format
specification that enables metadata tags to be added to existing JPEG, TIFF
and RIFF files. The Exif library makes it possible to parse an Exif file
and read this metadata.

An infinite recursion flaw was found in the way libexif parses Exif image
tags. If a victim opens a carefully crafted Exif image file, it could cause
the application linked against libexif to crash. (CVE-2007-6351)

An integer overflow flaw was found in the way libexif parses Exif image
tags. If a victim opens a carefully crafted Exif image file, it could cause
the application linked against libexif to execute arbitrary code, or crash.
(CVE-2007-6352)

Users of libexif are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.1 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.1 ia64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.1 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.1 s390x
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.1 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 425551 - CVE-2007-6351 libexif infinite recursion flaw (DoS)
  • BZ - 425561 - CVE-2007-6352 libexif integer overflow

Red Hat Enterprise Linux Server 5

SRPM
libexif-0.6.13-4.0.2.el5_1.1.src.rpm SHA-256: 6bcbc0e13f37639e01b48d97f9b2659b021ac4b69db42f0ed5a53a17b8c7f90a
x86_64
libexif-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: 104be15a3fef44003139258c7c25e117c7f2a6bec596d0b355aed416f7f36db2
libexif-0.6.13-4.0.2.el5_1.1.x86_64.rpm SHA-256: 9c6dac416d5aa733f66167eb9d651ffdb1f2e234fc7bb4639eb87602692794c9
libexif-devel-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: da4dd6dbf4e22c661b9efd22bfa1177030ce36a22f7e671583efe37dc5d711dc
libexif-devel-0.6.13-4.0.2.el5_1.1.x86_64.rpm SHA-256: 963b55d9e42722568421a7f7cab0304edc9734490cd2f28f818fac27fc4556f1
ia64
libexif-0.6.13-4.0.2.el5_1.1.ia64.rpm SHA-256: 50c0481891216dad254caf736aa63ce0ed6abae4a49377dfe6754007f2e4e3f3
libexif-devel-0.6.13-4.0.2.el5_1.1.ia64.rpm SHA-256: eb4922ef0c436f725509635def2bcb4ad04611c40c388c6c1d0d902d930e9d4d
i386
libexif-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: 104be15a3fef44003139258c7c25e117c7f2a6bec596d0b355aed416f7f36db2
libexif-devel-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: da4dd6dbf4e22c661b9efd22bfa1177030ce36a22f7e671583efe37dc5d711dc

Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.1

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Workstation 5

SRPM
libexif-0.6.13-4.0.2.el5_1.1.src.rpm SHA-256: 6bcbc0e13f37639e01b48d97f9b2659b021ac4b69db42f0ed5a53a17b8c7f90a
x86_64
libexif-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: 104be15a3fef44003139258c7c25e117c7f2a6bec596d0b355aed416f7f36db2
libexif-0.6.13-4.0.2.el5_1.1.x86_64.rpm SHA-256: 9c6dac416d5aa733f66167eb9d651ffdb1f2e234fc7bb4639eb87602692794c9
libexif-devel-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: da4dd6dbf4e22c661b9efd22bfa1177030ce36a22f7e671583efe37dc5d711dc
libexif-devel-0.6.13-4.0.2.el5_1.1.x86_64.rpm SHA-256: 963b55d9e42722568421a7f7cab0304edc9734490cd2f28f818fac27fc4556f1
i386
libexif-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: 104be15a3fef44003139258c7c25e117c7f2a6bec596d0b355aed416f7f36db2
libexif-devel-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: da4dd6dbf4e22c661b9efd22bfa1177030ce36a22f7e671583efe37dc5d711dc

Red Hat Enterprise Linux Desktop 5

SRPM
libexif-0.6.13-4.0.2.el5_1.1.src.rpm SHA-256: 6bcbc0e13f37639e01b48d97f9b2659b021ac4b69db42f0ed5a53a17b8c7f90a
x86_64
libexif-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: 104be15a3fef44003139258c7c25e117c7f2a6bec596d0b355aed416f7f36db2
libexif-0.6.13-4.0.2.el5_1.1.x86_64.rpm SHA-256: 9c6dac416d5aa733f66167eb9d651ffdb1f2e234fc7bb4639eb87602692794c9
i386
libexif-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: 104be15a3fef44003139258c7c25e117c7f2a6bec596d0b355aed416f7f36db2

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
libexif-0.6.13-4.0.2.el5_1.1.src.rpm SHA-256: 6bcbc0e13f37639e01b48d97f9b2659b021ac4b69db42f0ed5a53a17b8c7f90a
s390x
libexif-0.6.13-4.0.2.el5_1.1.s390.rpm SHA-256: 6aa59fc567cacdd4809c8d2a608b9a75b15f2f9745714b67a7cf3b7420da4293
libexif-0.6.13-4.0.2.el5_1.1.s390x.rpm SHA-256: fee410400f1c201263745cee3dd55cf636ad424391e5b64f9f9fc636c93abd44
libexif-devel-0.6.13-4.0.2.el5_1.1.s390.rpm SHA-256: 43e3b8f152ad38d52da1d20383707667c9d2aa5ad511305ffc0d4b88002f50ca
libexif-devel-0.6.13-4.0.2.el5_1.1.s390x.rpm SHA-256: 2b8f4e78ebf4e3c075c3c2f98e55947b1c73b0fe7e3bb6a6fd9c884437a33281

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.1

SRPM
s390x

Red Hat Enterprise Linux for Power, big endian 5

SRPM
libexif-0.6.13-4.0.2.el5_1.1.src.rpm SHA-256: 6bcbc0e13f37639e01b48d97f9b2659b021ac4b69db42f0ed5a53a17b8c7f90a
ppc
libexif-0.6.13-4.0.2.el5_1.1.ppc.rpm SHA-256: 803b61d2d62d4b1d93dc39825850af1e6ee8004b00ebd4d30f54ef16fb47c9b1
libexif-0.6.13-4.0.2.el5_1.1.ppc64.rpm SHA-256: 8a5cd382c8c522738e2492571763637b1de8fc8c9a74ae3ba1c9edaefe2fe83f
libexif-devel-0.6.13-4.0.2.el5_1.1.ppc.rpm SHA-256: e4081c530d29fdbb626caadbc2b16310fd5f73254e73d01d5c538ff253333dae
libexif-devel-0.6.13-4.0.2.el5_1.1.ppc64.rpm SHA-256: 08735857a90884ccdcd82a5da86af91291f1d5e8c8f7c55fe7c969134ffddd7e

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.1

SRPM
ppc

Red Hat Enterprise Linux Server from RHUI 5

SRPM
libexif-0.6.13-4.0.2.el5_1.1.src.rpm SHA-256: 6bcbc0e13f37639e01b48d97f9b2659b021ac4b69db42f0ed5a53a17b8c7f90a
x86_64
libexif-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: 104be15a3fef44003139258c7c25e117c7f2a6bec596d0b355aed416f7f36db2
libexif-0.6.13-4.0.2.el5_1.1.x86_64.rpm SHA-256: 9c6dac416d5aa733f66167eb9d651ffdb1f2e234fc7bb4639eb87602692794c9
libexif-devel-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: da4dd6dbf4e22c661b9efd22bfa1177030ce36a22f7e671583efe37dc5d711dc
libexif-devel-0.6.13-4.0.2.el5_1.1.x86_64.rpm SHA-256: 963b55d9e42722568421a7f7cab0304edc9734490cd2f28f818fac27fc4556f1
i386
libexif-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: 104be15a3fef44003139258c7c25e117c7f2a6bec596d0b355aed416f7f36db2
libexif-devel-0.6.13-4.0.2.el5_1.1.i386.rpm SHA-256: da4dd6dbf4e22c661b9efd22bfa1177030ce36a22f7e671583efe37dc5d711dc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.