CVE-2020-0093

MEDIUM EPSS 21.7%

Published May 14, 20206y ago · Modified Jun 17, 20262w ago

5.0 CVSS 3.1

Medium

Published May 14, 2020 6y ago

Last Modified Jun 17, 2026 2w ago

Description

In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148705132

CVSS Details

Base Score

5.0

Exploitability

1.3

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction Required

Scope Unchanged

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

21.7% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 13

Vendor	Product	Version	Range
google	android	8.0	any
google	android	8.1	any
google	android	9.0	any
google	android	10.0	any
debian	debian_linux	8.0	any
canonical	ubuntu_linux	12.04	any
canonical	ubuntu_linux	14.04	any
canonical	ubuntu_linux	16.04	any
canonical	ubuntu_linux	18.04	any
canonical	ubuntu_linux	19.10	any
canonical	ubuntu_linux	20.04	any
libexif_project	libexif	*	<0.6.22
opensuse	leap	15.1	any

References 5

lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html

Mailing ListThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html

Mailing ListThird Party Advisory
security.gentoo.org https://security.gentoo.org/glsa/202007-05

PatchThird Party Advisory
source.android.com https://source.android.com/security/bulletin/2020-05-01

PatchVendor Advisory
usn.ubuntu.com https://usn.ubuntu.com/4396-1/

Third Party Advisory

Remediation

security.gentoo.org https://security.gentoo.org/glsa/202007-05

PatchThird Party Advisory
source.android.com https://source.android.com/security/bulletin/2020-05-01

PatchVendor Advisory