Every CVESearch/Get API key

CVE-2006-4168

Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif...

6.8 MediumFix available

CVE-2006-4168 is a medium vulnerability (CVSS 6.8) in Libexif, published June 14, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.30%, the 91st percentile. Fixed in libexif 0.6.16-1.

Severity
6.8 MediumCVSS 2.0, NVD
Exploit chance
4.30%EPSS, 91st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.6.16-1libexif +24 more

Description

Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.

Exploit likelihood

4.30%Down 3.9 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libexif
Debian:12
before 0.6.16-1
0.6.16-1
libexif
Debian:13
before 0.6.16-1
0.6.16-1
libexif
Debian:14
before 0.6.16-1
0.6.16-1
libexif
Debian:4.0
before 0.6.13-5etch1, plus listed versions
0.6.13-5
0.6.13-5etch1
libexif
Debian:3.1
before 0.6.9-6sarge1, plus listed versions
0.6.9-6
0.6.9-6sarge1
libexif
Red Hat:enterprise_linux:4::as
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif-debuginfo
Red Hat:enterprise_linux:4::as
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif-devel
Red Hat:enterprise_linux:4::as
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif
Red Hat:enterprise_linux:4::desktop
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif-debuginfo
Red Hat:enterprise_linux:4::desktop
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
Show 15 moreShow less
Affected packages
PackageAffectedFixed
libexif-devel
Red Hat:enterprise_linux:4::desktop
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif
Red Hat:enterprise_linux:4::es
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif-debuginfo
Red Hat:enterprise_linux:4::es
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif-devel
Red Hat:enterprise_linux:4::es
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif
Red Hat:enterprise_linux:4::ws
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif-debuginfo
Red Hat:enterprise_linux:4::ws
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif-devel
Red Hat:enterprise_linux:4::ws
before 0:0.5.12-5.1.0.2
0:0.5.12-5.1.0.2
libexif
Red Hat:enterprise_linux:5::client_workstation
before 0:0.6.13-4.0.2.el5
0:0.6.13-4.0.2.el5
libexif-debuginfo
Red Hat:enterprise_linux:5::client_workstation
before 0:0.6.13-4.0.2.el5
0:0.6.13-4.0.2.el5
libexif-devel
Red Hat:enterprise_linux:5::client_workstation
before 0:0.6.13-4.0.2.el5
0:0.6.13-4.0.2.el5
libexif
Red Hat:enterprise_linux:5::client
before 0:0.6.13-4.0.2.el5
0:0.6.13-4.0.2.el5
libexif-debuginfo
Red Hat:enterprise_linux:5::client
before 0:0.6.13-4.0.2.el5
0:0.6.13-4.0.2.el5
libexif
Red Hat:enterprise_linux:5::server
before 0:0.6.13-4.0.2.el5
0:0.6.13-4.0.2.el5
libexif-debuginfo
Red Hat:enterprise_linux:5::server
before 0:0.6.13-4.0.2.el5
0:0.6.13-4.0.2.el5
libexif-devel
Red Hat:enterprise_linux:5::server
before 0:0.6.13-4.0.2.el5
0:0.6.13-4.0.2.el5

What each source reports

NVD Score used6.8

Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.

Record
CVE-2006-4168
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE ListNo score

Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.

Record
CVE-2006-4168
Updated
2026-11-02
EUVDEUVD-2006-4158No score

Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.

Record
EUVD-2006-4158
Updated
2026-11-03
GitHub AdvisoriesGHSA-6mcf-v3q9-5w3pNo score

Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif...

Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.

Record
GHSA-6mcf-v3q9-5w3p
Updated
2026-11-02
OSVNo score

Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.

Record
CVE-2006-4168
Updated
2026-11-02
OSVDEBIAN-CVE-2006-4168No score

Integer overflow in the exif_data_load_data_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via an image with many EXIF components, which triggers a heap-based buffer overflow.

Record
DEBIAN-CVE-2006-4168
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 30 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open