CVE-2017-7544

Name	CVE-2017-7544
Description	libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-2214-1
Debian Bugs	876466

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libexif (PTS)	buster, buster (security)	0.6.21-5.1+deb10u5	fixed
	bullseye	0.6.22-3	fixed
	bookworm, sid	0.6.24-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libexif	source	jessie	0.6.21-2+deb8u2	DLA-2214-1
libexif	source	stretch	0.6.21-2+deb9u2
libexif	source	(unstable)	0.6.21-2.1		876466

[wheezy] - libexif <no-dsa> (Minor issue)
https://sourceforge.net/p/libexif/bugs/130/