{"id":"ASB-A-159625731","details":"In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-159625731","CVE-2020-0452"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2020-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2020-11-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/external/libexif/+/8e7345f3bc0bad06ac369d6cbc1124c8ceaf7d4b"}],"affected":[{"package":{"name":"platform/external/libexif","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11-next:0"},{"fixed":"11-next:2020-11-01"}]}],"versions":["11-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7"],"severity":"High","spl":"2020-11-01","types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"263220040067256262802011496473458430110","length":17208},"id":"ASB-A-159625731-29557f15","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7","target":{"function":"exif_entry_get_value","file":"libexif/exif-entry.c"}},{"source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7","target":{"file":"libexif/exif-entry.c"},"deprecated":false,"digest":{"line_hashes":["284322438145339945043720915456140922165","93281639976837326739273976352982873884","18325982235928269788913677721160134997","288125191916546280087425276079803197919","61811470730497895629839865950923936795","85008742746889107741124549964262222027","320703541205510993089784264294519513012","174698835426192614860996725383857514855"],"threshold":0.9},"id":"ASB-A-159625731-58e1fa82","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-159625731.json"}},{"package":{"name":"platform/external/libexif","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2020-11-01"}]}],"versions":["8.0"],"ecosystem_specific":{"severity":"High","spl":"2020-11-01","types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["284322438145339945043720915456140922165","93281639976837326739273976352982873884","18325982235928269788913677721160134997","288125191916546280087425276079803197919","61811470730497895629839865950923936795","85008742746889107741124549964262222027","320703541205510993089784264294519513012","174698835426192614860996725383857514855"],"threshold":0.9},"id":"ASB-A-159625731-8a485f31","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/79b5fcdc0a58dd62094f09697fcc8033148c80df","target":{"file":"libexif/exif-entry.c"}},{"digest":{"function_hash":"263220040067256262802011496473458430110","length":17208},"id":"ASB-A-159625731-ecc8f716","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/79b5fcdc0a58dd62094f09697fcc8033148c80df","target":{"file":"libexif/exif-entry.c","function":"exif_entry_get_value"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/libexif/+/79b5fcdc0a58dd62094f09697fcc8033148c80df"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-159625731.json"}},{"package":{"name":"platform/external/libexif","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2020-11-01"}]}],"versions":["8.1"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7"],"severity":"High","spl":"2020-11-01","types":["RCE"],"vanir_signatures":[{"digest":{"function_hash":"263220040067256262802011496473458430110","length":17208},"id":"ASB-A-159625731-0f86e893","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7","target":{"file":"libexif/exif-entry.c","function":"exif_entry_get_value"},"deprecated":false},{"source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7","target":{"file":"libexif/exif-entry.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["284322438145339945043720915456140922165","93281639976837326739273976352982873884","18325982235928269788913677721160134997","288125191916546280087425276079803197919","61811470730497895629839865950923936795","85008742746889107741124549964262222027","320703541205510993089784264294519513012","174698835426192614860996725383857514855"]},"id":"ASB-A-159625731-610e5dce","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-159625731.json"}},{"package":{"name":"platform/external/libexif","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2020-11-01"}]}],"versions":["9"],"ecosystem_specific":{"severity":"High","spl":"2020-11-01","types":["RCE"],"vanir_signatures":[{"target":{"file":"libexif/exif-entry.c","function":"exif_entry_get_value"},"deprecated":false,"digest":{"length":17208,"function_hash":"263220040067256262802011496473458430110"},"id":"ASB-A-159625731-83fc9f95","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7","target":{"file":"libexif/exif-entry.c"},"deprecated":false,"digest":{"line_hashes":["284322438145339945043720915456140922165","93281639976837326739273976352982873884","18325982235928269788913677721160134997","288125191916546280087425276079803197919","61811470730497895629839865950923936795","85008742746889107741124549964262222027","320703541205510993089784264294519513012","174698835426192614860996725383857514855"],"threshold":0.9},"id":"ASB-A-159625731-ca9f79df","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-159625731.json"}},{"package":{"name":"platform/external/libexif","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-11-01"}]}],"versions":["10"],"ecosystem_specific":{"spl":"2020-11-01","types":["RCE"],"vanir_signatures":[{"id":"ASB-A-159625731-9c1db66a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7","target":{"file":"libexif/exif-entry.c","function":"exif_entry_get_value"},"deprecated":false,"digest":{"function_hash":"263220040067256262802011496473458430110","length":17208}},{"target":{"file":"libexif/exif-entry.c"},"deprecated":false,"digest":{"line_hashes":["284322438145339945043720915456140922165","93281639976837326739273976352982873884","18325982235928269788913677721160134997","288125191916546280087425276079803197919","61811470730497895629839865950923936795","85008742746889107741124549964262222027","320703541205510993089784264294519513012","174698835426192614860996725383857514855"],"threshold":0.9},"id":"ASB-A-159625731-c0534477","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7"}],"fixes":["https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-159625731.json"}},{"package":{"name":"platform/external/libexif","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2020-11-01"}]}],"versions":["11"],"ecosystem_specific":{"vanir_signatures":[{"target":{"function":"exif_entry_get_value","file":"libexif/exif-entry.c"},"deprecated":false,"digest":{"function_hash":"263220040067256262802011496473458430110","length":17208},"id":"ASB-A-159625731-36a8ca9e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7"},{"id":"ASB-A-159625731-ec8d54ab","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7","target":{"file":"libexif/exif-entry.c"},"deprecated":false,"digest":{"line_hashes":["284322438145339945043720915456140922165","93281639976837326739273976352982873884","18325982235928269788913677721160134997","288125191916546280087425276079803197919","61811470730497895629839865950923936795","85008742746889107741124549964262222027","320703541205510993089784264294519513012","174698835426192614860996725383857514855"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/external/libexif/+/4c18b0fabf48fe4460b679805b0442d76a78bde7"],"severity":"High","spl":"2020-11-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-159625731.json"}}],"schema_version":"1.9.0"}