CVE-2012-2814
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing...
CVE-2012-2814 is a high vulnerability (CVSS 7.5) in Libexif Project Libexif, published July 13, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.62%, the 94th percentile. Fixed in libexif 0.6.21-r0.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 7.62%EPSS, 94th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.6.21-r0libexif +41 more
Description
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libexifAlpine:v3.10 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.11 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.12 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.13 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.14 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.15 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.16 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.17 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.18 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.19 | before 0.6.21-r0 | 0.6.21-r0 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libexifAlpine:v3.20 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.21 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.22 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.23 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.24 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.8 | before 0.6.21-r0 | 0.6.21-r0 |
libexifAlpine:v3.9 | before 0.6.21-r0 | 0.6.21-r0 |
libexifDebian:12 | before 0.6.20-3 | 0.6.20-3 |
libexifDebian:13 | before 0.6.20-3 | 0.6.20-3 |
libexifDebian:14 | before 0.6.20-3 | 0.6.20-3 |
libexifDebian:6.0 From an advisory covering 7 CVEs | before 0.6.19-1+squeeze1, plus listed versions 0.6.19-1 | 0.6.19-1+squeeze1 |
libexifRed Hat:enterprise_linux:5::client From an advisory covering 7 CVEs | before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 7 CVEs | before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexifRed Hat:enterprise_linux:5::client_workstation From an advisory covering 7 CVEs | before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 7 CVEs | before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 7 CVEs | before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexifRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs | before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs | before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexif-develRed Hat:enterprise_linux:5::server From an advisory covering 7 CVEs | before 0:0.6.21-1.el5_8 | 0:0.6.21-1.el5_8 |
libexifRed Hat:enterprise_linux:6::client From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-develRed Hat:enterprise_linux:6::client From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexifRed Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-develRed Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexifRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-develRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexifRed Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexif-develRed Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs | before 0:0.6.21-5.el6_3 | 0:0.6.21-5.el6_3 |
libexifopenSUSE:Tumbleweed From an advisory covering 7 CVEs | before 0.6.21-10.8 | 0.6.21-10.8 |
What each source reports
NVD Score used
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
- Record
CVE-2012-2814- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
- Record
CVE-2012-2814- Updated
- 2026-11-02
EUVDEUVD-2012-2794No score
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
- Record
EUVD-2012-2794- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fh9g-f6cg-q7xfNo score
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing...
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
- Record
GHSA-fh9g-f6cg-q7xf- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2012-2814
CVE-2012-2814 does not affect BellSoft software
- Record
BELL-CVE-2012-2814- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSVALPINE-CVE-2012-2814No score
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
- Record
ALPINE-CVE-2012-2814- Updated
- 2026-11-03
OSVNo score
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
- Record
CVE-2012-2814- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2814No score
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
- Record
DEBIAN-CVE-2012-2814- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10510-1No score
libexif-devel-0.6.21-10.8 on GA media
These are all security issues fixed in the libexif-devel-0.6.21-10.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10510-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/54437
debian.org/security/2012/dsa-2559
lists.opensuse.org/opensuse-security-announce/2012-07/msg00015.html
sourceforge.net/mailarchive/message.php?msg_id=29534027
secunia.com/advisories/49988
rhn.redhat.com/errata/RHSA-2012-1255.html
Show 45 moreShow less
oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
ubuntu.com/usn/USN-1513-1
nvd.nist.gov/vuln/detail/CVE-2012-2814
github.com/advisories/GHSA-fh9g-f6cg-q7xf
security.alpinelinux.org/vuln/CVE-2012-2814
docs.bell-sw.com/security/cves/CVE-2012-2814
security-tracker.debian.org/tracker/CVE-2012-2814
access.redhat.com/errata/RHSA-2012:1255
bugzilla.redhat.com/show_bug.cgi?id=839182
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1255.json
cve.org/CVERecord?id=CVE-2012-2812
suse.com/security/cve/CVE-2012-2812