USN-478-1: libexif vulnerability

Ubuntu Security Notice USN-478-1

26th June, 2007

libexif vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 7.04
  • Ubuntu 6.10
  • Ubuntu 6.06 LTS


Sean Larsson discovered that libexif did not correctly verify the size of
EXIF components. By tricking a user into opening an image with specially
crafted EXIF headers, a remote attacker could cause the application
using libexif to execute arbitrary code with user privileges.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 7.04:
libexif12 0.6.13-5ubuntu0.2
Ubuntu 6.10:
libexif12 0.6.13-4ubuntu0.2
Ubuntu 6.06 LTS:
libexif12 0.6.12-2ubuntu0.2

To update your system, please follow these instructions:

After a standard system upgrade you need to restart your session to
effect the necessary changes.