Log in Start free

Vulnerability · Published Jun 11, 2020 · Assigned by google_android

CVE-2020-0198

High 7.5

In plain English

A high-severity security flaw in Android. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.3%top 8.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20libexif0.6.23-r0ALPINE-CVE-2020-0198
Alpine:v3.21libexif0.6.23-r0ALPINE-CVE-2020-0198
Alpine:v3.22libexif0.6.23-r0ALPINE-CVE-2020-0198
Alpine:v3.23libexif0.6.23-r0ALPINE-CVE-2020-0198
Alpine:v3.24libexif0.6.23-r0ALPINE-CVE-2020-0198
Debian:12libexif0.6.22-2DEBIAN-CVE-2020-0198
Debian:13libexif0.6.22-2DEBIAN-CVE-2020-0198
Debian:14libexif0.6.22-2DEBIAN-CVE-2020-0198

Affected products (as reported)

VendorProductVersions
n/a Android Android-10

References