Every CVE Search/ Get API key

CVE-2020-0182

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing...

6.5 MediumFix available

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

1.13%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917

Record
CVE-2020-0182
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917

Record
CVE-2020-0182
Updated
2026-11-02
EUVDEUVD-2020-1686 No score

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917

Record
EUVD-2020-1686
Updated
2026-11-03
GitHub AdvisoriesGHSA-5mj9-pf4j-ccp7 No score

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing...

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917

Record
GHSA-5mj9-pf4j-ccp7
Updated
2026-11-02
OSV 6.5

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917

Record
CVE-2020-0182
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2020-0182 6.5

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917

Record
DEBIAN-CVE-2020-0182
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2020:4040 8.2

Red Hat Security Advisory: libexif security, bug fix, and enhancement update

Record
RHSA-2020:4040
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:4766 8.2

Red Hat Security Advisory: libexif security, bug fix, and enhancement update

Record
RHSA-2020:4766
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-0182 6.5

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147140917

Record
UBUNTU-CVE-2020-0182
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVUSN-4396-1 No score

libexif vulnerabilities

It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2020-0093, CVE-2020-0182)

It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this issue to cause a remote denial of service. (CVE-2020-0198)

It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information or cause a crash. (CVE-2020-13112)

It was discovered that libexif incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash. (CVE-2020-13113)

It was discovered libexif incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-13114)

Record
USN-4396-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libexif
Debian:12
 before 0.6.22-1
0.6.22-1
libexif
Debian:13
 before 0.6.22-1
0.6.22-1
libexif
Debian:14
 before 0.6.22-1
0.6.22-1
libexif
Debian:8
 before 0.6.21-2+deb8u4, plus listed versions
0.6.21-20.6.21-2+deb8u10.6.21-2+deb8u20.6.21-2+deb8u3
0.6.21-2+deb8u4
libexif
Red Hat:enterprise_linux:7::client
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-devel
Red Hat:enterprise_linux:7::client
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-doc
Red Hat:enterprise_linux:7::client
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif
Red Hat:enterprise_linux:7::computenode
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
Show 20 moreShow less
Affected packages
PackageAffectedFixed
libexif-devel
Red Hat:enterprise_linux:7::computenode
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-doc
Red Hat:enterprise_linux:7::computenode
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif
Red Hat:enterprise_linux:7::server
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-devel
Red Hat:enterprise_linux:7::server
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-doc
Red Hat:enterprise_linux:7::server
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif
Red Hat:enterprise_linux:7::workstation
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif-doc
Red Hat:enterprise_linux:7::workstation
 before 0:0.6.22-1.el7
0:0.6.22-1.el7
libexif
Red Hat:enterprise_linux:8::appstream
 before 0:0.6.22-4.el8
0:0.6.22-4.el8
libexif-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.6.22-4.el8
0:0.6.22-4.el8
libexif-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.6.22-4.el8
0:0.6.22-4.el8
libexif-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:0.6.22-4.el8
0:0.6.22-4.el8
libexif-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:0.6.22-4.el8
0:0.6.22-4.el8
libexif-devel
Red Hat:enterprise_linux:8::crb
 before 0:0.6.22-4.el8
0:0.6.22-4.el8
libexif
Ubuntu:Pro:14.04:LTS
 before 0.6.21-1ubuntu1+esm5, plus listed versions
0.6.21-10.6.21-1ubuntu10.6.21-1ubuntu1+esm10.6.21-1ubuntu1+esm2
0.6.21-1ubuntu1+esm5
libexif
Ubuntu:16.04:LTS
 before 0.6.21-2ubuntu0.5, plus listed versions
0.6.21-20.6.21-2ubuntu0.10.6.21-2ubuntu0.2
0.6.21-2ubuntu0.5
libexif
Ubuntu:18.04:LTS
 before 0.6.21-4ubuntu0.5, plus listed versions
0.6.21-2.10.6.21-40.6.21-4ubuntu0.10.6.21-4ubuntu0.2
0.6.21-4ubuntu0.5
libexif
Ubuntu:20.04:LTS
 before 0.6.21-6ubuntu0.3, plus listed versions
0.6.21-5.10.6.21-60.6.21-6ubuntu0.1
0.6.21-6ubuntu0.3

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-0182 is a medium vulnerability (CVSS 6.5) in Google Android, published June 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in libexif 0.6.22-1.

References

Show 47 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open